CVE-2022-42466CWE-79

XSS vulnerability, eg for String properties.

Medium · published October 19, 2022

CVSS v3.1
6.1
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01444 · 73.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-10-19T00:00Z
EPSS history
Timeline
  • 19 OCT 00:00Z
    XSS vulnerability, eg for String properties.
    cvelistv5