CVE-2022-2113: Stored XSS in inventree/inventree
CVE ID: CVE-2022-2113
Date: June 17, 2022
Severity: Medium (CVSS 3.1: 5.4)
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Affected: inventree/inventree prior to 0.7.2
Fixed in: 0.7.2
🔍 Overview
A stored cross-site scripting (XSS) vulnerability exists in GitHub repository inventree/inventree prior to version 0.7.2. The application fails to sanitize user-supplied input before storing and rendering it in web pages, allowing an attacker to inject persistent JavaScript that executes when other users view the affected content.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector: Network, low complexity, low privileges, user interaction required, changed scope.
🎯 Impact
Stored XSS is particularly dangerous because the payload persists in the application and is served to every user who visits the compromised page, including administrators. Potential consequences include:
- Session hijacking and account takeover
- Unauthorized actions performed on behalf of victims
- Credential harvesting and phishing
🛡️ Mitigation
Upgrade to InvenTree 0.7.2 or later. Sanitize all user input on the server side before storage, and apply context-aware output encoding when rendering stored content in HTML.