exploitDog

CVE-2022-48612

Опубликовано: 16 окт. 2023

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.

Ссылки

https://blog.zerdle.net/classlink/
Exploit
Third Party Advisory
https://blog.zerdle.net/classlink/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:classlink:oneclick:*:*:*:*:*:*:*:*

Версия до 10.7 (включая)

EPSS

Процентиль: 31%

0.00117

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-w6rw-h3mq-8rp8

CVSS3: 6.1

github

больше 2 лет назад

A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.

EPSS

Процентиль: 31%

0.00117

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79