Lucene search

MitreCVE-2022-27063

HistoryApr 08, 2022 - 9:15 a.m.

CVE-2022-27063

2022-04-0809:15:11

CWE-79

mitre

web.nvd.nist.gov

aerocms

v0.0.1

stored xss

view_all_comments.php

vulnerability

nvd

cve-2022-27063

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.007

Percentile

81.0%

JSON

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.

Affected configurations

Nvd

Node

aerocms_projectaerocmsMatch0.0.1

VendorProductVersionCPE
aerocms_projectaerocms0.0.1cpe:2.3:a:aerocms_project:aerocms:0.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
aerocms_project	aerocms	0.0.1	cpe:2.3:a:aerocms_project:aerocms:0.0.1:::::::*

References

packetstormsecurity.com/files/166649/AeroCMS-0.0.1-Cross-Site-Scripting.html

drive.google.com/file/d/1GxOyX1JkG0trfdaCLfe06TR6WLIGoUXE/view?usp=sharing

github.com/D4rkP0w4r/AeroCMS-Comment-Stored_XSS-Poc

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.007

Percentile

81.0%

JSON

Related for CVE-2022-27063