Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24854 State: PUBLISHED Published: 2022-04-14T21:40:11.000Z Last Updated: 2025-04-23T18:39:11.015Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: metabase Products: metabase Problem Types: CWE-610 Description: Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file
d database, and then it can query across all the tables. To be able to do that the attacker also needs to know the file path to the second database. Users are advised to upgrade as soon as possible. If you're unable to upgrade, you can modify your SQLIte connection strings to contain the url argument `?limit_attached=0`, which will disallow making connections to other SQLite databases. Only users making use of SQLite are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-vm79-xvmp-7329 - https://www.sqlite.org/lang_attach.html
CVE ID: CVE-2022-24855 State: PUBLISHED Published: 2022-04-14T21:35:11.000Z Last Updated: 2025-04-23T18:39:18.551Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: metabase Products: metabase Problem Types: CWE-79 Description: Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The
are advised to either upgrade immediately, or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-wjw6-wm9w-7ggr - https://github.com/metabase/metabase/releases/tag/v0.42.4
CVE ID: CVE-2022-24856 State: PUBLISHED Published: 2022-05-17T15:25:11.000Z Last Updated: 2025-04-23T18:25:36.919Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: flyteorg Products: flyteconsole Problem Types: CWE-918 Description: FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `co
thenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 - https://github.com/flyteorg/flyteconsole/pull/389 - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709 - https://github.com/flyteorg/flyteconsole/releases/tag/v0.52.0
CVE ID: CVE-2022-24857 State: PUBLISHED Published: 2022-04-15T18:50:11.000Z Last Updated: 2025-04-23T18:38:55.074Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: xi Products: django-mfa3 Problem Types: CWE-287 Description: django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be bypassed. Users are affected if they have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prev
if they have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prevent users from accessing the admin login view. The issue has been fixed in django-mfa3 0.5.0. It is possible to work around the issue by overwriting the admin login route, e.g. by adding the following URL definition *before* the admin routes: url('admin/login/', lambda request: redirect(settings.LOGIN_URL) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xi/django-mfa3/security/advisories/GHSA-3r7g-wrpr-j5g4 - https://github.com/xi/django-mfa3/commit/32f656e22df120b84bdf010e014bb19bd97971de - https://github.com/xi/
g-wrpr-j5g4 - https://github.com/xi/django-mfa3/commit/32f656e22df120b84bdf010e014bb19bd97971de - https://github.com/xi/django-mfa3/blob/main/CHANGES.md#050-2022-04-15 - https://security.netapp.com/advisory/ntap-20220609-0003/
CVE ID: CVE-2022-24858 State: PUBLISHED Published: 2022-04-19T22:25:10.000Z Last Updated: 2025-04-23T18:33:56.817Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: nextauthjs Products: next-auth Problem Types: CWE-290 Description: next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`. Additional Analyst Notes: - CVE Progr
allback, make sure that you match the incoming `url` origin against the `baseUrl`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw - https://next-auth.js.org/configuration/callbacks#redirect-callback - https://next-auth.js.org/getting-started/upgrade-v4
CVE ID: CVE-2022-24859 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-04-22T18:15:17.460Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: py-pdf Products: PyPDF2 Problem Types: CWE-835 Description: PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually
the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/PyPDF2/security/advisories/GHSA-xcjx-m2pj-8g79 - https://github.com/py-pdf/PyPDF2/issues/329 - https://github.com/py-pdf/PyPDF2/pull/740 - https://github.com/py-pdf/PyPDF2/releases/tag/1.27.5 - https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html - https://lists.d
py-pdf/PyPDF2/releases/tag/1.27.5 - https://lists.debian.org/debian-lts-announce/2022/06/msg00001.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00013.html
CVE ID: CVE-2022-24860 State: PUBLISHED Published: 2022-04-19T23:25:27.000Z Last Updated: 2025-04-22T18:15:07.408Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: vran-dev Products: databasir Problem Types: CWE-321 Description: Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vran-dev/databasir/security/ad
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpgg - https://github.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java - https://user-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png - https://user-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png - https://user-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png
CVE ID: CVE-2022-24861 State: PUBLISHED Published: 2022-04-20T18:15:13.000Z Last Updated: 2025-04-22T18:14:57.028Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: vran-dev Products: databasir Problem Types: CWE-20 Description: Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue. Additional Analyst Notes: - CVE Program Container: -
e advised to upgrade. There are no known workarounds to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vran-dev/databasir/security/advisories/GHSA-5r2v-wcwh-7xmp - https://github.com/vran-dev/databasir/pull/103 - https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b
CVE ID: CVE-2022-24862 State: PUBLISHED Published: 2022-04-20T18:20:10.000Z Last Updated: 2025-04-22T18:14:47.698Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: vran-dev Products: databasir Problem Types: CWE-918 Description: Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the download verification process of a JDBC driver the corresponding JDBC driver download address will be downloaded first, but this address will return a response page with complete error information when accessing a non-existent URL. Attackers can take advantage of this feature for S
ge with complete error information when accessing a non-existent URL. Attackers can take advantage of this feature for SSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vran-dev/databasir/security/advisories/GHSA-r8m9-r74j-vc6m - https://github.com/vran-dev/databasir/releases/tag/v1.0.2
CVE ID: CVE-2022-24863 State: PUBLISHED Published: 2022-04-18T19:00:22.000Z Last Updated: 2025-04-23T18:34:13.994Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: swaggo Products: http-swagger Problem Types: CWE-400 Description: http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" meth
of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv - https://github.com/swaggo/http-swagger/pull/62 - https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e - https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
CVE ID: CVE-2022-24864 State: PUBLISHED Published: 2022-04-20T18:25:12.000Z Last Updated: 2025-04-23T18:33:38.078Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: OriginProtocol Products: origin-website Problem Types: CWE-79 Description: Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient
ginprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7 - https://github.com/OriginProtocol/origin-website/pull/617 - https://github.com/github/codeql/pull/7127
CVE ID: CVE-2022-24865 State: PUBLISHED Published: 2022-04-20T20:05:10.000Z Last Updated: 2025-04-22T18:14:38.048Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: humhub Products: humhub Problem Types: CWE-200 Description: HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gi
nds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/humhub/humhub/security/advisories/GHSA-2h35-f226-3f57 - https://github.com/humhub/humhub/commit/eb83de20aaecc559ab77a44a6179646a99607e33 - https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76/
CVE ID: CVE-2022-24866 State: PUBLISHED Published: 2022-04-26T18:45:12.000Z Last Updated: 2025-04-23T18:32:16.933Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-assign Problem Types: CWE-200 Description: Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer serialized the whole User / Group object, which leaked some private information. The data was only being serialized to people who could view assignment info, which is limited to staff by default. For the vast majority of sites, this data was only leaked to trusted staff
t info, which is limited to staff by default. For the vast majority of sites, this data was only leaked to trusted staff member, but for sites with assign features enabled publicly, the data was accessible to more people than just staff. Version 1.0.1 contains a patch. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-assign/security/advisories/GHSA-9xhf-wvjx-f5w9 - https://github.com/discourse/discourse-assign/pull/320
CVE ID: CVE-2022-24867 State: PUBLISHED Published: 2022-04-21T16:50:11.000Z Last Updated: 2025-04-23T18:33:08.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-200 Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue. Additional A
ee the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-4r49-52q9-5fgr - https://github.com/glpi-project/glpi/commit/26f0a20810db11641afdcf671bac7a309acbb94e
CVE ID: CVE-2022-24868 State: PUBLISHED Published: 2022-04-21T16:55:11.000Z Last Updated: 2025-04-23T18:32:59.539Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user viewing the avatar will be subject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow S
ubject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow SVG avatars. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-9hg4-fpwv-gx78 - https://github.com/glpi-project/glpi/commit/1aa9fcc4741a46fa5a9f11d71b409b911ffc190f
CVE ID: CVE-2022-24869 State: PUBLISHED Published: 2022-04-21T17:00:16.000Z Last Updated: 2025-04-23T18:32:52.595Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade. Additional Analyst Notes: - C
rtially mitigated by cors security of browsers, though users are still advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-p94c-8qp5-gfpx - https://github.com/glpi-project/glpi/commit/ac9f1f03c5d2545b7e290197dbfebc3f752f810e - https://github.com/glpi-project/glpi/blob/10.0/bugfixes/CHANGELOG.md#1000-2022-04-20 - https://github.com/glpi-project/glpi/releases/tag/10.0.0
CVE ID: CVE-2022-24870 State: PUBLISHED Published: 2022-04-21T16:40:12.000Z Last Updated: 2025-04-22T18:14:28.943Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
rkarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-29h7-jw2p-pcw3 - https://huntr.dev/bounties/1625056040123-Combodo/iTop/?token=4d1195d5a50a9f0f7ae9fc24a2b0a3bd907427edaf7ee6ac1f8f31c11d8b7a5d2c204957125e63fd7cf3a87df6d5d12a35f9c7107ba5f33b5f668fa199a36932448b9bf186daa62cb32b5635770730eb68eeeba079b8864ab00358fd0dc65fa406d986525814a14951db2025e117f0098a1f270f5a5b2c935a65b00b5106e5511b61d501c4357654cb8ea76b - https://www.github.com/combodo/itop/commit/ebbf6e56befda2070b00d68c7c3e531a6ce6b59e
CVE ID: CVE-2022-24871 State: PUBLISHED Published: 2022-04-20T19:05:11.000Z Last Updated: 2025-04-23T18:33:32.808Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: shopware Products: platform Problem Types: CWE-918 Description: Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue. Additional Analyst Notes: - CV
measures are also available via a plugin. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-7gm7-8q8v-9gf2 - https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022
CVE ID: CVE-2022-24872 State: PUBLISHED Published: 2022-04-20T19:15:14.000Z Last Updated: 2025-04-23T18:33:26.483Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: shopware Products: platform Problem Types: CWE-732 Description: Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - C
able via a plugin. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77c - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022 - https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc
CVE ID: CVE-2022-24873 State: PUBLISHED Published: 2022-04-28T13:45:14.000Z Last Updated: 2025-04-23T18:31:52.852Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: shopware Products: shopware Problem Types: CWE-79 Description: Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/adv
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59w - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022 - https://www.shopware.com/en/changelog-sw5/#5-7-9
CVE ID: CVE-2022-24874 State: REJECTED Published: 2022-04-20T20:20:09 Last Updated: 2022-04-22T20:30:55 Description: No description available.