What is GHSA-5h7w-hmxc-99g5?

GHSA-5h7w-hmxc-99g5 is a security advisory published by GitHub Security Advisories with Medium severity. Cross site scripting in safe-svg

Which CVE IDs does GHSA-5h7w-hmxc-99g5 cover?

GHSA-5h7w-hmxc-99g5 covers the following CVE IDs: CVE-2022-1091. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5h7w-hmxc-99g5?

GHSA-5h7w-hmxc-99g5 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5h7w-hmxc-99g5?

GHSA-5h7w-hmxc-99g5 affects 1 product, including: composer/darylldoyle/safe-svg:\u003c 1.9.10.

GHSA-5h7w-hmxc-99g5MediumCVSS 6.1

Cross site scripting in safe-svg

Vendor

GitHub Security Advisories

Published

April 19, 2022

Last Modified

April 17, 2023

🔗 CVE IDs covered (1)

CVE-2022-1091 →

📋 Description

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).

🎯 Affected products1

composer/darylldoyle/safe-svg:< 1.9.10

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-1091
https://github.com/10up/safe-svg/pull/28
https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3
https://github.com/10up/safe-svg/commit/00cb9a86d1bff2214714557d1901ec3896564e50
https://github.com/advisories/GHSA-5h7w-hmxc-99g5