6.1

CVE-2022-42466

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Isis Version < 2.0.0
Apache ≫ Isis Version2.0.0 Updatemilestone1
Apache ≫ Isis Version2.0.0 Updatemilestone2
Apache ≫ Isis Version2.0.0 Updatemilestone3
Apache ≫ Isis Version2.0.0 Updatemilestone4
Apache ≫ Isis Version2.0.0 Updatemilestone5
Apache ≫ Isis Version2.0.0 Updatemilestone6
Apache ≫ Isis Version2.0.0 Updatemilestone7
Apache ≫ Isis Version2.0.0 Updatemilestone8
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.07% 0.894
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.