CVE-2022-43706
CVSS V2 None
CVSS V3 None
Description
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
Overview
- CVE ID
- CVE-2022-43706
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2022-12-05T23:15:09.757
- Last Modified Date
- 2022-12-06T20:33:40.097
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:stackstorm:stackstorm:*:*:*:*:*:*:*:* | 1 | OR | 3.8.0 |
References
| Reference URL | Reference Tags |
|---|---|
| https://stackstorm.com/2022/12/v3-8-0-released/ | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-43706 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43706 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-12-07 18:06:39 | Added to TrackCVE |