Lucene search
GitHub Advisory DatabaseGHSA-HF94-8MX5-2VVJHistoryNov 21, 2022 - 9:30 p.m.
Cross-site Scripting in kiwitcms
2022-11-2121:30:15
CWE-79
GitHub Advisory Database
github.com
7
xss
kiwitcms
test plan
ui redressing
clickjacking
html injection
history page
software
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.4%
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Affected configurations
Node
kiwitcmsRange<11.6
Related
cvelist
cvelist
CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
2022-11-21 00:00:00
prion
prion
Design/Logic Flaw
2022-11-21 20:15:00
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 04:57:12
cve
cve
CVE-2022-4105
2022-11-21 20:15:11
nvd
nvd
CVE-2022-4105
2022-11-21 20:15:11
osv
osv
CVE-2022-4105
2022-11-21 20:15:11
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
huntr
huntr
Stored XSS and HTML injection from markdown
2022-11-02 16:43:12
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.4%
Related for GHSA-HF94-8MX5-2VVJ