CVE-2022-32171: 
NixOS vulnerability analysis and mitigation

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting (XSS) when using the delete user functionality. The vulnerability was discovered and disclosed on October 6, 2022, affecting the Zinc search platform. When an authenticated user deletes a user having an XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user's credentials (Mend Database).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4. The attack vector is Network-based, with low attack complexity and requiring low privileges. User interaction is required, and the scope is changed. The vulnerability has low impact on both confidentiality and integrity, with no impact on availability (NVD).

When exploited, the vulnerability allows an attacker to execute malicious JavaScript code when an authenticated user deletes a user account containing an XSS payload. If the payload contains a request to the attacker's domain, the credentials of the user who performed the deletion will be sent encoded in base64 to the attacker, potentially allowing unauthorized access to the system (Mend Database).

The vulnerability has been fixed in Zinc version v0.3.2. Users are advised to upgrade to this version or later. The fix involves proper escaping of user input in the delete user functionality, as evidenced by the code changes in the repository (GitHub Commit).