xcss/valine · Security
Valine code injection vulnerability
- GHSA ID
- GHSA-mcvg-g9wx-v5vx
- CVE ID
- CVE-2022-38545
- Severity
- critical
- Published
- Updated
- CVSS
- 9.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 9.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')