CSV Injection in inventree

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-2112 · ADVISORY
• inventree/inventree commit 26bf51c · WEB
• inventree/InvenTree · PACKAGE
• huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73 · WEB
• pypi.org/project/inventree · PACKAGE
• GitHub Advisory GHSA-9hx5-jmxv-x44q · ADVISORY

inventree のその他の脆弱性

• GHSA-vx3h-qwqw-r2wq中 4.3Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP
• CVE-2022-3355中 5.4Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.
• GHSA-85q9-7467-r53q高XSS Vulnerability in Markdown Editor
• CVE-2022-2111高 8.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
• GHSA-7rq4-qcpw-74gq中Formula Injection in Exported Data