Lucene search

VulDBCVELIST:CVE-2022-4902

HistoryFeb 06, 2023 - 6:31 p.m.

CVE-2022-4902 eXo Chat Application Mention ExoChatMessageComposer.vue cross site scripting

2023-02-0618:31:03

CWE-79

VulDB

www.cve.org

exo chat application

mention handler

vue component

cross site scripting

upgrade

cve-2022-4902

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

39.6%

JSON

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212.

CNA Affected

[
  {
    "vendor": "eXo",
    "product": "Chat Application",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ],
    "modules": [
      "Mention Handler"
    ]
  }
]

References

community.exoplatform.com/portal/dw/tasks/taskDetail/56304

github.com/exoplatform/chat-application/commit/26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc

github.com/exoplatform/chat-application/pull/485

github.com/exoplatform/chat-application/releases/tag/3.3.0-20220417

vuldb.com/?ctiid.220212

vuldb.com/?id.220212

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

39.6%

JSON

Related for CVELIST:CVE-2022-4902