CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

2022-11-2100:00:00

CWE-79

@huntrdev

www.cve.org

cross-site scripting

stored

kiwitcms/kiwi

test plan

malicious javascript

ui redressing

clickjacking

html injection

history page disabled

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

CNA Affected

[
  {
    "vendor": "kiwitcms",
    "product": "kiwitcms/kiwi",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "11.6",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]