CVE-2022-3355

Description

Inventree prior to 0.8.3 is vulnerable to stored cross-site scripting by uploading SVG files. Version 0.8.3 contains a patch for this issue.

How to fix CVE-2022-3355

To remediate CVE-2022-3355, upgrade the affected package to a fixed version below.

• PyPI/inventree—upgrade to 0.8.3 or later

Is CVE-2022-3355 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.8.3

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-3355
• PATCHgithub.com/inventree/inventree
• WEBgithub.com/inventree/inventree/commit/5a08ef908dd5344b4433436a4679d122f7f99e41
• WEBgithub.com/inventree/InvenTree/releases/tag/0.8.3