GitHub Advisoryadvisory · Maven

GHSA-j34r-57xj-pfm5 WSO2 carbon-registry Cross-site Scripting vulnerability

MEDIUM Published 2022-12-15 Modified 2022-12-20 Official page ↗
Aliases
CVE-2022-4520
Ecosystem
Maven
Packages
org.wso2.carbon.registry:carbon-registry
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-20

Affected packages

• Maven org.wso2.carbon.registry:carbon-registry: < 4.8.12 → fixed in 4.8.12

Description

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp` of the component `Advanced Search`. The manipulation of the argument `mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue` leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 can address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.

Related

Alias · CVE (1)

  • CVE-2022-4520 A vulnerability was found in WSO2 carbon-registry up to 4.8.11. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References