{"id":"GHSA-j2xf-p274-g8cc","aliases":["CVE-2022-30110"],"title":"Cross-site Scripting in Jirafeau","description":"The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.","severity":"medium","score":6.1,"published":"2022-05-18T00:00:45.000Z","modified":"2023-11-08T04:09:16.465Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mojo42/jirafeau","ranges":[{"events":[{"introduced":"0"},{"fixed":"4.4.0"}],"type":"ECOSYSTEM"}],"versions":["4.3.0"],"fixed":["4.4.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-30110","https://gitlab.com/mojo42/Jirafeau","https://gitlab.com/mojo42/Jirafeau/-/merge_requests/103"],"sources":[{"name":"OSV","id":"GHSA-j2xf-p274-g8cc","modified":"2023-11-08T04:09:16.465299Z","url":"https://osv.dev/vulnerability/GHSA-j2xf-p274-g8cc"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}