Lucene search

GoogleOSV:CVE-2022-35910

HistoryAug 19, 2022 - 1:15 p.m.

CVE-2022-35910

2022-08-1913:15:08

Google

osv.dev

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.4%

JSON

In Jellyfin before 10.8, stored XSS allows theft of an admin access token.

CPENameOperatorVersion
jellyfineq10.1.0
jellyfineq10.3.1
jellyfineq3.5.2-5
jellyfineq10.3.4
jellyfineq10.3.0-rc2
jellyfineq10.2.2
jellyfineq10.6.0
jellyfineq10.2.1
jellyfineq10.3.0
jellyfineq10.8.0-alpha4

Name	Operator	Version
jellyfin	eq	10.1.0
jellyfin	eq	10.3.1
jellyfin	eq	3.5.2-5
jellyfin	eq	10.3.4
jellyfin	eq	10.3.0-rc2
jellyfin	eq	10.2.2
jellyfin	eq	10.6.0
jellyfin	eq	10.2.1
jellyfin	eq	10.3.0
jellyfin	eq	10.8.0-alpha4

Rows per page:

1-10 of 311

References

docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit

github.com/jellyfin/jellyfin/pull/7569/files

medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.4%

JSON

Related for OSV:CVE-2022-35910