// For flags

CVE-2022-23646

Improper CSP in Image Optimization API for Next.js

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.

Next.js es un framework de React. A partir de la versión 10.0.0 y versiones anteriores a 12.1.0, Next.js es vulnerable a una tergiversación de información crítica en la Interfaz de Usuario (UI). Para estar afectado, el archivo "next.config.js" debe tener asignada una matriz "images.domains" y el host de imágenes asignado en "images.domains" debe permitir el SVG proporcionado por el usuario. Si el archivo "next.config.js" presenta asignado "images.loader" a algo distinto de lo predeterminado, la instancia no estará afectada. La versión 12.1.0 contiene un parche para este problema. Como medida de mitigación, cambie "next.config.js" para usar "loader configuration" diferente a la predeterminada

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-19 CVE Reserved
  • 2022-02-17 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-11-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-451: User Interface (UI) Misrepresentation of Critical Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vercel
Search vendor "Vercel"
 Next.js
Search vendor "Vercel" for product "Next.js"
 >= 10.0.0 < 12.1.0
Search vendor "Vercel" for product "Next.js" and version " >= 10.0.0 < 12.1.0"
node.js
Affected