CVE-2022-43984 json
Browsershot 3.57.3 - Server Side XSS to LFR via HTML
published 3y ago modified 4mo ago also GHSA-6q49-35h6-rq2p , EUVD-2022-7259
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
Patch / fix
- packagist spatie/browsershot 3.57.4
Is CVE-2022-43984 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- fluidattacks.com https://fluidattacks.com/advisories/malone/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | spatie/browsershot | <3.57.4 |
3.57.4 |
Affected products
- n/a Browsershot
Classification
References
-
github.com
/spatie/browsershot/commit/554c3e566fde8c47ad1ac9be47eaeb9a84c4dfe2
web
-
github.com
/spatie/browsershot/commit/92cf16fc098211731f80d21687abeafbe2c457ad
web
-
fluidattacks.com
/advisories/malone/
exploit, third-party-advisory
-
github.com
/spatie/browsershot/
product
-
nvd.nist.gov
/vuln/detail/CVE-2022-43984
advisory
-
fluidattacks.com
/advisories/malone
web
-
github.com
/spatie/browsershot
web
Sources
- CVE List CVE-2022-43984
- GitHub Advisory GHSA-6q49-35h6-rq2p
- NVD CVE-2022-43984
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.