CVE-2022-41706 — Browsershot 3.57.2 - Server Side XSS to LFR via URL

CVE-2022-41706

Browsershot 3.57.2 - Server Side XSS to LFR via URL PUBLISHED

Description (CNA)

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.

Affected (CNA)

Vendor / product	Versions
n/a / Browsershot	affected 3.57.2

CWE

No CWE identifiers supplied.

References

https://github.com/spatie/browsershot/
https://fluidattacks.com/advisories/eminem/

ADP enrichment

CVE

No English description supplied.

https://github.com/spatie/browsershot/
https://fluidattacks.com/advisories/eminem/

CISA-ADP

No English description supplied.

No references supplied.