Lucene search

SnykCVE-2022-25854

HistoryApr 29, 2022 - 8:15 p.m.

CVE-2022-25854

2022-04-2920:15:07

CWE-79

snyk

web.nvd.nist.gov

cve-2022-25854

package vulnerability

xss

ui components

input fields

text fields

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.9%

JSON

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

Affected configurations

Nvd

Node

tagify_projecttagifyRange<4.9.8

VendorProductVersionCPE
tagify_projecttagify*cpe:2.3:a:tagify_project:tagify:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tagify_project	tagify	*	cpe:2.3:a:tagify_project:tagify::::::::

CNA Affected

[
  {
    "product": "@yaireo/tagify",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "4.9.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/

github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7

github.com/yairEO/tagify/issues/988

github.com/yairEO/tagify/releases/tag/v4.9.8

snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.9%

JSON

Related for CVE-2022-25854