CVE-2022-21149 MEDIUM

CVE-2022-21149: Cross-site Scripting (XSS)

Vendor N/A
Product s-cart/s-cart
Published May 1, 2022
Last update September 16, 2024

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.

Key dates

02Disclosure timeline

May 1, 2022 CVE published
September 16, 2024 Record updated