CVE-2022-1345: XSS in Organizr ≤2.1.1810

The impact of CVE-2022-1345 is severe due to the nature of XSS vulnerabilities. Successful exploitation allows an attacker to inject arbitrary JavaScript code into the context of a user's browser session. This code can then be used to steal session cookies, redirect users to malicious websites, or deface the application. The attacker could potentially gain complete control over the affected user's account, accessing sensitive data and performing actions on their behalf. Given the vulnerability's location within a GitHub repository, it could potentially impact a wide range of users who utilize or integrate Organizr into their workflows. The ease of uploading files makes this a relatively low-skill attack.

1. Reserved2022-04-13
2. Published2022-04-13
3. Modified2024-08-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-1345 is to immediately upgrade Organizr to version 2.1.1810 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing strict file upload validation to prevent the upload of .svg files. Web Application Firewalls (WAFs) can be configured to block requests containing suspicious SVG content. Regularly scan the GitHub repository for unauthorized file uploads and monitor user activity for signs of malicious script execution. After upgrading, verify the fix by attempting to upload a known malicious SVG file and confirming that the script execution is blocked.