GitHub Advisoryadvisory · PyPI

GHSA-hf94-8mx5-2vvj Cross-site Scripting in kiwitcms

MEDIUM Published 2022-11-21 Modified 2022-11-23 Official page ↗
Aliases
CVE-2022-4105
Ecosystem
PyPI
Packages
kiwitcms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-22

Affected packages

• PyPI kiwitcms: < 11.6 → fixed in 11.6

Description

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

Related

Alias · CVE (1)

  • CVE-2022-4105 A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References