CVE-2022-38080

Опубликовано: 24 авг. 2022

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.

Ссылки

https://exment.net/docs/#/release_note?id=v503-20220817
Patch
Release Notes
Vendor Advisory
https://exment.net/docs/#/weakness/20220817
Mitigation
Patch
Vendor Advisory
https://jvn.jp/en/jp/JVN46239102/index.html
Third Party Advisory
https://exment.net/docs/#/release_note?id=v503-20220817
Patch
Release Notes
Vendor Advisory
https://exment.net/docs/#/weakness/20220817
Mitigation
Patch
Vendor Advisory
https://jvn.jp/en/jp/JVN46239102/index.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:exceedone:exment:*:*:*:*:*:*:*:*

Версия до 5.0.2 (включая)

cpe:2.3:a:exceedone:laravel-admin:*:*:*:*:*:*:*:*

Версия до 3.0.1 (включая)

EPSS

Процентиль: 58%

0.00369

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-8629-83m5-rj75