Lucene search

INCDCVELIST:CVE-2022-34768

HistoryAug 21, 2022 - 12:00 a.m.

CVE-2022-34768 Synel - eHarmony Stored XSS

2022-08-2100:00:00

CWE-79

INCD

www.cve.org

cve-2022-34768

synel

eharmony

stored xss

html

javascript

workers

vulnerable input

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

31.8%

JSON

insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.

CNA Affected

[
  {
    "product": "eHarmony",
    "vendor": "Synel",
    "versions": [
      {
        "lessThan": "v11*",
        "status": "affected",
        "version": "v11",
        "versionType": "custom"
      }
    ]
  }
]

References

www.gov.il/en/departments/faq/cve_advisories