PT-2022-3569 · Unknown +4 · Action View +4

🗓️ 27 Apr 2022 00:00:00Reported by Positive TechnologiesType

Cross site scripting in Action View tag helpers due to untrusted attribute keys; upgrade to fixed versions or escape input.

Reporter	Title	Published	Views	Family All 1696
zdt	PyTorch Model Server Registration / Deserialization Remote Code Execution Exploit	15 Oct 202300:00	–	zdt
zdt	Apache Commons Text 1.9 Remote Code Execution Exploit	21 Jan 202400:00	–	zdt
OSV	CGA-PH22-M678-XJ9W	7 Sep 202614:08	–	osv
OSV	CGA-PH69-JHP4-WVMM	7 Sep 202614:58	–	osv
OSV	CGA-PHHW-QXVX-XWRH	30 Oct 202520:52	–	osv
OSV	CGA-PM6C-V2R8-GGJR	1 Sep 202611:47	–	osv
OSV	CGA-PM9M-M5XG-PPQR	18 Dec 202500:59	–	osv
OSV	CGA-PMQ7-39RF-3X37	30 Oct 202519:29	–	osv
OSV	CGA-PMQH-2VFM-97XG	7 Sep 202617:26	–	osv
OSV	CGA-PQFQ-8MQV-7P3J	5 Aug 202617:07	–	osv

Source	Link
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/torchserver_cve_2023_43654.rb
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_commons_text4shell.rb
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
github	www.github.com/karthikuj/cve-2022-42889-text4shell-docker
github	www.github.com/kljunowsky/CVE-2022-42889-text4shell
github	www.github.com/tangxiaofeng7/CVE-2022-33980-Apache-Commons-Configuration-RCE
github	www.github.com/ClickCyber/cve-2022-42889
github	www.github.com/SeanWrightSec/CVE-2022-42889-PoC
github	www.github.com/HKirito/CVE-2022-33980
github	www.github.com/cxzero/CVE-2022-42889-text4shell

27 Jul 2024 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 26.4 - 7.5

CVSS 3.19.8

EPSS0.99931

SSVC