{"containers": {"cna": {"affected": [{"product": "upload", "vendor": "FriendsOfFlarum", "versions": [{"status": "affected", "version": "< 1.2.3"}]}], "descriptions": [{"lang": "en", "value": "FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-31T12:59:54", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/FriendsOfFlarum/upload/issues/68"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/FriendsOfFlarum/upload/pull/318"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3"}], "source": {"advisory": "GHSA-fm53-mpmp-7qw2", "discovery": "UNKNOWN"}, "title": "Possible cross-site scripting attack via unsanitized SVG files in FoF Upload", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-30999", "STATE": "PUBLIC", "TITLE": "Possible cross-site scripting attack via unsanitized SVG files in FoF Upload"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "upload", "version": {"version_data": [{"version_value": "< 1.2.3"}]}}]}, "vendor_name": "FriendsOfFlarum"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2", "refsource": "CONFIRM", "url": "https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2"}, {"name": "https://github.com/FriendsOfFlarum/upload/issues/68", "refsource": "MISC", "url": "https://github.com/FriendsOfFlarum/upload/issues/68"}, {"name": "https://github.com/FriendsOfFlarum/upload/pull/318", "refsource": "MISC", "url": "https://github.com/FriendsOfFlarum/upload/pull/318"}, {"name": "https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3", "refsource": "MISC", "url": "https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3"}]}, "source": {"advisory": "GHSA-fm53-mpmp-7qw2", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-30999", "datePublished": "2022-05-25T21:30:14", "dateReserved": "2022-05-18T00:00:00", "dateUpdated": "2022-05-31T12:59:54", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:friendsofflarum:upload:*:*:*:*:*:*:*:*", "matchCriteriaId": "4032D11B-9F0D-4933-B0DE-4234C95F6448", "versionEndExcluding": "1.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload."}, {"lang": "es", "value": "FriendsofFlarum (FoF) Upload es una extensi\u00f3n que maneja las subidas de archivos de forma inteligente para su foro. Si FoF Upload versiones anteriores a 1.2.3, est\u00e1 configurado para permitir la subida de archivos SVG (\"image/svg+xml\"), la navegaci\u00f3n directa a un URI de archivo SVG podr\u00eda ejecutar c\u00f3digo Javascript arbitrario decidido por un atacante. Este c\u00f3digo Javascript podr\u00eda incluir la ejecuci\u00f3n de peticiones web HTTP a Flarum, o a cualquier otro servicio web. Esto podr\u00eda permitir la filtraci\u00f3n de datos por parte de un usuario autenticado de Flarum, o, posiblemente, la modificaci\u00f3n de datos de forma maliciosa. Este problema ha sido parcheado con la versi\u00f3n v1.2.3, que ahora sanea los archivos SVG cargados. Como mitigaci\u00f3n , elimine la posibilidad de que los usuarios suban archivos SVG mediante FoF Upload"}], "id": "CVE-2022-30999", "lastModified": "2022-06-10T16:02:14.483", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-06-02T14:15:56.373", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/FriendsOfFlarum/upload/issues/68"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FriendsOfFlarum/upload/pull/318"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}