Lucene search

GoogleOSV:CVE-2022-36304

HistoryJul 19, 2022 - 7:15 p.m.

CVE-2022-36304

2022-07-1919:15:11

Google

osv.dev

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.

CPENameOperatorVersion
vestaeq0.9.8-16
vestaeq1.0.0-4
vestaeq0.9.8-12
vestaeq0.9.8-11
vestaeq0.9.8-20
vestaeq1.0.0-5
vestaeq0.9.8-19
vestaeq0.9.8-15
vestaeq0.9.8-27
vestaeq0.9.8-25

Name	Operator	Version
vesta	eq	0.9.8-16
vesta	eq	1.0.0-4
vesta	eq	0.9.8-12
vesta	eq	0.9.8-11
vesta	eq	0.9.8-20
vesta	eq	1.0.0-5
vesta	eq	0.9.8-19
vesta	eq	0.9.8-15
vesta	eq	0.9.8-27
vesta	eq	0.9.8-25

Rows per page:

1-10 of 171

References

github.com/serghey-rodin/vesta/issues/2252

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Related for OSV:CVE-2022-36304