Lucene search
HistoryJan 04, 2024 - 9:15 p.m.
CVE-2024-22048
govuk_tech_docs
versions
cross-site scripting
vulnerability
malicious javascript
search page
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
32.6%
govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user’s browser if a malicious search result is displayed on the search page.
Affected configurations
Node
gov.ukgovuk_tech_docsRange2.0.2–3.3.1ruby
| Vendor | Product | Version | CPE |
|---|---|---|---|
| gov.uk | govuk_tech_docs | * | cpe:2.3:a:gov.uk:govuk_tech_docs:*:*:*:*:*:ruby:*:* |
Related
osv
osv
govuk_tech_docs vulnerable to unescaped HTML on search results page
2023-04-11 15:41:30
CVE-2024-22048
2024-01-04 21:15:09
cve
cve
CVE-2024-22048
2024-01-04 21:15:09
veracode
veracode
Cross Site Scripting (XSS)
2024-01-05 09:57:26
rubygems
rubygems
govuk_tech_docs vulnerable to unescaped HTML on search results page
2023-04-10 21:00:00
prion
prion
Cross site scripting
2024-01-04 21:15:00
vulnrichment
vulnrichment
CVE-2024-22048 govuk_tech_docs XSS Vulnerability
2024-01-04 20:39:59
github
github
govuk_tech_docs vulnerable to unescaped HTML on search results page
2023-04-11 15:41:30
cvelist
cvelist
CVE-2024-22048 govuk_tech_docs XSS Vulnerability
2024-01-04 20:39:59
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
32.6%
Related for NVD:CVE-2024-22048