Lucene search
GitHub Advisory DatabaseGHSA-HF94-8MX5-2VVJHistoryNov 21, 2022 - 9:30 p.m.
Cross-site Scripting in kiwitcms
2022-11-2121:30:15
CWE-79
GitHub Advisory Database
github.com
6
xss
kiwitcms
test plan
ui redressing
clickjacking
html injection
history page
software
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.6%
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Affected configurations
Node
kiwitcmskiwi_tcmsRange<11.6
Related
cvelist
cvelist
CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
2022-11-21 00:00:00
prion
prion
Design/Logic Flaw
2022-11-21 20:15:00
osv
osv
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
CVE-2022-4105
2022-11-21 20:15:11
huntr
huntr
Stored XSS and HTML injection from markdown
2022-11-02 16:43:12
cve
cve
CVE-2022-4105
2022-11-21 20:15:11
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 04:57:12
nvd
nvd
CVE-2022-4105
2022-11-21 20:15:11
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.6%
Related for GHSA-HF94-8MX5-2VVJ