CVE-2022-22126

OpenMCT vulnerability CVE-2022-22126: OpenMCT versions 1.3.0 to 1.7.7 are affected by a stored XSS in the Web Page element, allowing injection of malicious JavaScript via the URL field. Affected product/version mix references NASA OpenMCT 1.7.7 and earlier 1.3.0+; the issue is consistent across m...

CVE-2022-23054

OpenMCT (NASA) versions 1.3.0–1.7.7 are vulnerable to stored XSS via the Summary Widget’s URL field. Root cause: the URL value is not properly escaped/filtered, enabling injection of malicious JavaScript. Impact described: attacker can inject code into the field, with related persistence/impact a...

CVE-2022-23053

OpenMCT is vulnerable to stored XSS via the Condition Widget URL field, affecting NASA OpenMCT 1.7.7 and earlier 1.3.0+ releases. Root cause: insufficient escaping/validation of URL input in the Condition Widget, enabling injection of JavaScript. Connected sources corroborate across Red Hat CVE e...

CVE-2023-45282

In NASA Open MCT (openmct), a prototype pollution vulnerability affects versions 2.2.5 through 3.1.0 via an import action. The issue is fixed by upgrading to version 3.1.0 or later. This corresponds to an impact on availability and integrity as indicated by CVSS 3.1 metrics, but exploitation deta...

CVE-2023-45885

NASA Open MCT (aka openmct) up to version 3.1.0 is affected by a Cross Site Scripting (XSS) vulnerability in the flexibleLayout plugin’s new component feature that can lead to arbitrary code execution. The root cause is the ability to inject or execute code via the component feature, enabling an ...

CVE-2023-45884

CVE-2023-45884 is a CSRF vulnerability in NASA Open MCT (openmct) up to and including version 3.1.0, exposed via the flexibleLayout plugin. Attackers can view sensitive information; the available documents do not specify a fixed patch or remediation, only that the issue exists through 3.1.0.