CVE-2022-24710CWE-79

Cross-site Scripting in Weblate

Medium · published February 25, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00753 · 54.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-25T20:50Z
EPSS history
Timeline
  • 25 FEB 20:50Z
    Cross-site Scripting in Weblate
    cvelistv5