svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all     users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There     is currently no workaround available. (CVE-2022-23638)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7318-1 advisory.

    It was discovered that svg-sanitizer, vendored in SPIP, did not properly sanitize SVG/XML content. An     attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu     24.10. (CVE-2022-23638)

    It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use     this issue to perform cross site scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)

    It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use     this issue to perform PHP injection attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)

    It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use     this issue to perform SQL injection attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28961)

    It was discovered that SPIP did not properly sanitize certain inputs. A remote authenticated attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2022-37155)

    It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use     this issue to perform SQL injection attacks. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04     LTS. (CVE-2023-24258)

    It was discovered that SPIP did not properly handle serialization under certain circumstances. A remote     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04     LTS and Ubuntu 20.04 LTS. (CVE-2023-27372)

    It was discovered that SPIP did not properly sanitize HTTP requests. A remote attacker could possibly use     this issue to execute arbitrary code. (CVE-2024-8517)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all
    users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There
    is currently no workaround available. (CVE-2022-23638)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0eab001a-9708-11ec-96c9-589cfc0f81b0 advisory.

  - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all     users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There     is currently no workaround available. (CVE-2022-23638)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262464	Linux Distros Unpatched Vulnerability : CVE-2022-23638	Nessus	Misc.	medium
218738	Ubuntu 18.04 LTS / 20.04 LTS / 24.10 : SPIP vulnerabilities (USN-7318-1)	Nessus	Ubuntu Local Security Checks	critical
414657	SCA: security update for enshrined/svg-sanitize (GHSA-fqx8-v33p-4qcc)	Tenable Cloud Security	SCA Checks	medium
414657	SCA: security update for enshrined/svg-sanitize (GHSA-fqx8-v33p-4qcc)	Tenable Self-Hosted Container Security	SCA Checks	medium
158451	FreeBSD : typo3 -- XSS vulnerability in svg-sanitize (0eab001a-9708-11ec-96c9-589cfc0f81b0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-23638

medium

Tenable Plugins

medium

critical

medium

medium

medium