Lucene search
GoogleOSV:GHSA-HF94-8MX5-2VVJHistoryNov 21, 2022 - 9:30 p.m.
Cross-site Scripting in kiwitcms
2022-11-2121:30:15
Google
osv.dev
5
cross-site scripting
kiwitcms
stored xss
test plan
malicious javascript
html injection
ui redressing attack
clickjacking
history page
software
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.4%
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Related
prion
prion
Design/Logic Flaw
2022-11-21 20:15:00
cvelist
cvelist
CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
2022-11-21 00:00:00
huntr
huntr
Stored XSS and HTML injection from markdown
2022-11-02 16:43:12
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 04:57:12
cve
cve
CVE-2022-4105
2022-11-21 20:15:11
nvd
nvd
CVE-2022-4105
2022-11-21 20:15:11
osv
osv
CVE-2022-4105
2022-11-21 20:15:11
github
github
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
21.4%
Related for OSV:GHSA-HF94-8MX5-2VVJ