CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects Sirv: from n/a through <= 7.5.3.
Explanation of Vulnerability in Simple Terms
Sirv versions up to 7.5.3 contain a cross-site scripting vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and affects the scope beyond the vulnerable component. An attacker with low privileges can craft a malicious request that, when clicked by a victim, executes arbitrary JavaScript in their browser session.
What an attacker can do
Inject and execute malicious JavaScript in a victim's browser within the Sirv application context.
Potential impact on your site
Users' sessions and data within Sirv could be compromised if they click attacker-controlled links; account takeover or data theft is possible.
Conditions required to exploit
Attacker must have a low-privilege account and trick a victim into clicking a malicious link or visiting a crafted page.
Key dates
External resources
Related vulnerabilities
