Lucene search

@huntrdevCVE-2022-3127

HistorySep 05, 2022 - 1:15 p.m.

CVE-2022-3127

2022-09-0513:15:08

CWE-79

@huntrdev

web.nvd.nist.gov

cve-2022-3127

cross-site scripting

xss

github

jgraph

drawio

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

30.0%

JSON

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

Affected configurations

Nvd

Node

diagramsdrawioRange<20.2.8

VendorProductVersionCPE
diagramsdrawio*cpe:2.3:a:diagrams:drawio:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
diagrams	drawio	*	cpe:2.3:a:diagrams:drawio::::::::

CNA Affected

[
  {
    "product": "jgraph/drawio",
    "vendor": "jgraph",
    "versions": [
      {
        "lessThan": "20.2.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/jgraph/drawio/commit/59887e45b36f06c8dd4919a32bacd994d9f084da

huntr.dev/bounties/6cea89d1-39dc-4023-82fa-821f566b841a

Social References

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

30.0%

JSON

Related for CVE-2022-3127