Lucene search
GoogleOSV:CVE-2022-4105HistoryNov 21, 2022 - 8:15 p.m.
CVE-2022-4105
2022-11-2120:15:11
Google
osv.dev
5
cve-2022-4105
software
malicious javascript
clickjacking
history page
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
5.4
Confidence
High
EPSS
0.001
Percentile
21.4%
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Related
prion
prion
Design/Logic Flaw
2022-11-21 20:15:00
cvelist
cvelist
CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
2022-11-21 00:00:00
huntr
huntr
Stored XSS and HTML injection from markdown
2022-11-02 16:43:12
osv
osv
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
veracode
veracode
Cross-site Scripting (XSS)
2022-11-23 04:57:12
nvd
nvd
CVE-2022-4105
2022-11-21 20:15:11
cve
cve
CVE-2022-4105
2022-11-21 20:15:11
github
github
Cross-site Scripting in kiwitcms
2022-11-21 21:30:15
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
5.4
Confidence
High
EPSS
0.001
Percentile
21.4%
Related for OSV:CVE-2022-4105