Lucene search

GoogleOSV:CVE-2022-4875

HistoryJan 04, 2023 - 10:15 p.m.

CVE-2022-4875

2023-01-0422:15:09

Google

osv.dev

fossology

remote attack

cross site scripting

patch

vdb-217426

CVSS2

3.3

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:M/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

39.9%

JSON

A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability.

CPENameOperatorVersion
fossologyeq2.5.0
fossologyeq3.4.0-rc1
fossologyeq3.9.0-rc2
fossologyeq4.2.1
fossologyeq3.10.0-rc2
fossologyeq3.11.0-rc1
fossologyeq3.8.0-rc1
fossologyeq3.0.0rc1
fossologyeq4.1.0-rc1
fossologyeq3.2.0

Name	Operator	Version
fossology	eq	2.5.0
fossology	eq	3.4.0-rc1
fossology	eq	3.9.0-rc2
fossology	eq	4.2.1
fossology	eq	3.10.0-rc2
fossology	eq	3.11.0-rc1
fossology	eq	3.8.0-rc1
fossology	eq	3.0.0rc1
fossology	eq	4.1.0-rc1
fossology	eq	3.2.0

Rows per page:

1-10 of 441

References

github.com/fossology/fossology/commit/8e0eba001662c7eb35f045b70dd458a4643b4553

github.com/fossology/fossology/pull/2356

vuldb.com/?ctiid.217426

vuldb.com/?id.217426

CVSS2

3.3

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:M/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

39.9%

JSON

Related for OSV:CVE-2022-4875