[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2022-23515":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":23,"technologies":27,"references":31,"score":42,"epss_score":43,"epss_percentile":44,"is_kev":45,"cisa_kev_date_added":46,"cisa_kev_due_date":46,"cisa_ssvc":47,"attack_mappings":53,"exploits":60},314728,"CVE-2022-23515","EUVD-2022-7470","Improper neutralization of data URIs may allow XSS in Loofah\n\n## Summary\n\nLoofah `>= 2.1.0, \u003C 2.19.1` is vulnerable to cross-site scripting via the `image\u002Fsvg+xml` media type in data URIs.\n\n\n## Mitigation\n\nUpgrade to Loofah `>= 2.19.1`.\n\n\n## Severity\n\nThe Loofah maintainers have evaluated this as [Medium Severity 6.1](https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fcalculator\u002F3.0#CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N).\n\n\n## References\n\n- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F79.html)\n- [SVG MIME Type (image\u002Fsvg+xml) is misleading to developers · Issue #266 · w3c\u002Fsvgwg](https:\u002F\u002Fgithub.com\u002Fw3c\u002Fsvgwg\u002Fissues\u002F266)\n- https:\u002F\u002Fhackerone.com\u002Freports\u002F1694173\n- https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah\u002Fissues\u002F101\n\n## Credit\n\nThis vulnerability was responsibly reported by Maciej Piechota (@haqpl).","2022-12-13T17:39:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":18,"attackComplexity":17,"availabilityImpact":19,"privilegesRequired":19,"confidentialityImpact":17},"CHANGED","3.1",6.1,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","LOW","REQUIRED","NONE",true,[22],"CWE-79",[24,25,26],"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:a:loofah_project:loofah:*:*:*:*:*:ruby:*:*","cpe:2.3:a:loofah:loofah:*:*:*:*:*:*:*:*",[28,29,30],"Loofah_Project Loofah","Debian Debian Linux","Loofah Loofah",[32,33,34,35,36,37,38,39,40,41],"https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah\u002Fissues\u002F101","https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah\u002Fsecurity\u002Fadvisories\u002FGHSA-228g-948r-83gx","https:\u002F\u002Fhackerone.com\u002Freports\u002F1694173","https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2023\u002F09\u002Fmsg00011.html","https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00044.html","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-23515","https:\u002F\u002Fgithub.com\u002Fw3c\u002Fsvgwg\u002Fissues\u002F266","https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah\u002Fcommit\u002F415677f3cf7f9254f42f811e784985cd63c7407f","https:\u002F\u002Fgithub.com\u002Fflavorjones\u002Floofah","https:\u002F\u002Fgithub.com\u002Frubysec\u002Fruby-advisory-db\u002Fblob\u002Fmaster\u002Fgems\u002Floofah\u002FCVE-2022-23515.yml",0.66,0.00859,0.58213,false,null,{"timestamp":46,"automatable":48,"tech_impact":49,"exploitation":50,"cisa_decision":51,"cisa_remediation_timeline":52},"no","partial","none",{},"FSU",[54],{"name":55,"source":56,"tactics":57,"technique_id":59},"Exploit Public-Facing Application","attack_vector",[58],"initial-access","T1190",[61],{"link":34}]