Vulnerability · Published Oct 6, 2022 · Assigned by Mend
CVE-2022-32171Zinc - Stored XSS
Unrated
In plain English
A cross-site scripting in zinc from zinc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS )–Not rated
Exploit odds (30 days)0.7%top 48.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/zinclabs/zinc | 0.3.2 | GHSA-4fgv-8448-gf82 |
| Go | github.com/zinclabs/zinc | 0.3.2 | GO-2023-1895 |
| Go | github.com/zincsearch/zincsearch | 0.3.2 | GHSA-4fgv-8448-gf82 |
Affected products (as reported)
Weakness: CWE-79