Recipes - Stored XSS in Add to Cart

Description

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

Scores

EPSS (exploitation in 30 days)

0.85% · top 42% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• recipes · recipes

  • affected 1.0.5 – < unspecified
  • affected unspecified – ≤ 1.2.5

What to do

Solution: Update version to 1.2.6 or later

References (2)

• https://www.mend.io/vulnerability-database/CVE-2022-23072 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-23072](https://trackcve.app/badge/CVE-2022-23072.svg)](https://trackcve.app/cve/CVE-2022-23072)

Record last updated 16 Sept 2024, 17:57 UTC.