Lucene search
HistoryNov 21, 2022 - 8:15 p.m.
CVE-2022-4105
stored xss
kiwi test plan
ui redressing
clickjacking
html injection
history page
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.6%
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Affected configurations
Node
kiwitcmskiwi_tcmsRange<11.6
Related
cvelist
cvelist
CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
2022-11-21 00:00:00
prion
prion
Design/Logic Flaw
2022-11-21 20:15:00
cve
cve
CVE-2022-4105
2022-11-21 20:15:11
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 04:57:12
osv
osv
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
CVE-2022-4105
2022-11-21 20:15:11
huntr
huntr
Stored XSS and HTML injection from markdown
2022-11-02 16:43:12
github
github
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
21.6%
Related for NVD:CVE-2022-4105