Lucene search

HWCVELIST:CVE-2022-3895

HistoryNov 15, 2022 - 2:24 p.m.

CVE-2022-3895 Potential XSS in common user interface component library

2022-11-1514:24:49

CWE-79

www.cve.org

cve-2022-3895

user interface

common

component library

output sanitization

arbitrary html

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

31.3%

JSON

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).

CNA Affected

[
  {
    "vendor": "Hallo Welt! GmbH",
    "product": "Common User Interface Component",
    "versions": [
      {
        "version": "3",
        "status": "affected",
        "lessThan": "3.0.5",
        "versionType": "custom"
      }
    ]
  }
]

References

en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

31.3%

JSON

Related for CVELIST:CVE-2022-3895