CVE-2022-23073

Name: CVE-2022-23073
Creator: NVD / NIST
Published: 2022-06-21T09:15:08.913+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.79%

Last modified Jun 17, 2026

CVE-2022-23073 is a vulnerability of currently unknown severity. In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. EPSS estimates a 0.79% chance of exploitation in the next 30 days.

Description

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

Metrics

EPSS Probability

0.79%

51.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Tandoor	Recipes	>= 1.0.5, <= 1.2.5

References

https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6Patch, Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-23073Exploit, Third Party Advisory
https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6Patch, Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-23073Exploit, Third Party Advisory

Timeline

Published: Jun 21, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-23073?

How severe is CVE-2022-23073?

Severity scoring for CVE-2022-23073 is pending analysis. The EPSS model estimates a 0.79% probability of exploitation in the next 30 days.

How do I fix CVE-2022-23073?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-23073?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST