CVE-2022-22116
Summary
| CVE | CVE-2022-22116 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-01-10 16:15:00 UTC |
| Updated | 2022-01-14 19:33:00 UTC |
| Description | In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rangerstudio | Directus | 9.0.0 | - | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha10 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha11 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha12 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha13 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha14 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha15 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha16 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha17 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha18 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha19 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha20 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha21 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha22 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha23 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha24 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha25 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha26 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha27 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha31 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha32 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha33 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha34 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha35 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha36 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha37 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha38 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha39 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha4 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha40 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha41 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha42 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha5 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha6 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha7 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha8 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | alpha9 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta0 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta1 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta10 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta11 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta12 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta13 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta14 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta2 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta3 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta4 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta5 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta7 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta8 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | beta9 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc0 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc1 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc10 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc100 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc101 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc11 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc12 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc13 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc14 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc15 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc17 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc18 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc19 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc2 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc20 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc21 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc22 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc23 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc24 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc25 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc26 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc27 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc28 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc29 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc3 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc30 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc31 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc32 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc33 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc34 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc35 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc36 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc37 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc38 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc39 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc4 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc40 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc41 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc42 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc43 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc44 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc45 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc46 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc47 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc48 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc49 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc5 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc50 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc51 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc52 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc53 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc54 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc55 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc56 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc57 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc58 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc59 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc6 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc60 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc61 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc62 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc63 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc64 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc65 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc66 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc67 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc68 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc69 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc7 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc70 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc71 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc72 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc73 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc74 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc75 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc76 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc77 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc78 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc79 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc8 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc80 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc81 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc82 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc83 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc84 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc85 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc86 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc87 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc88 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc89 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc9 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc90 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc91 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc92 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc93 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc94 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc95 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc96 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc97 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc98 | All | All |
| Application | Rangerstudio | Directus | 9.0.0 | rc99 | All | All |
| Application | Rangerstudio | Directus | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Add Content-Security-Policy header by default (#10776) · directus/directus@ec86d54 · GitHub | MISC | github.com | |
| CVE-2022-22116 | WhiteSource Vulnerability Database | MISC | www.whitesourcesoftware.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: WhiteSource Vulnerability Research Team (WVR)
There are currently no legacy QID mappings associated with this CVE.