CVE-2022-1091
Safe SVG < 1.9.10 - SVG Sanitisation Bypass
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
18 abr 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Productos afectados
Unknown · Safe SVG¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →