CVE-2022-42225

CVSS V2 None CVSS V3 None

Description

Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascript under admin's permission.

Overview

CVE ID
CVE-2022-42225

Assigner
cve@mitre.org

Vulnerability Status
Received

Published Version
2023-05-24T20:15:09

Last Modified Date
2023-05-24T20:15:09

References

Reference URL	Reference Tags
https://gist.github.com/bybit-sec/eb750c1d906c89e97092b29015472738
https://github.com/jumpserver/lina/blob/v2.10.0/src/views/settings/SystemMessageSubscription/SelectDialog.vue#L43
https://github.com/jumpserver/lina/blob/v2.11.0/src/layout/components/NavHeader/SiteMessages.vue#L40
https://github.com/jumpserver/lina/blob/v2.26.0/src/views/tickets/components/Comments.vue#L16

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-42225
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42225

History

Created	Old Value	New Value	Data Type	Notes
2023-05-24 21:00:37				Added to TrackCVE