Inventree vulnerable to Stored Cross-site Scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-3355 · ADVISORY
• inventree/inventree commit 5a08ef9 · WEB
• inventree/InvenTree release 0.8.3 · WEB
• inventree/inventree · PACKAGE
• huntr.dev/bounties/4b7fb92c-f06b-4bbf-82dc-9f013b30b6a6 · WEB
• pypi.org/project/inventree · PACKAGE
• GitHub Advisory GHSA-62g7-fpv9-v95f · ADVISORY

inventree のその他の脆弱性

• GHSA-vx3h-qwqw-r2wq中 4.3Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP
• GHSA-85q9-7467-r53q高XSS Vulnerability in Markdown Editor
• CVE-2022-2112高 8.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
• CVE-2022-2111高 8.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
• GHSA-7rq4-qcpw-74gq中Formula Injection in Exported Data