CVE-2022-38295

MEDIUMNuclei

Cuppa CMS v1.0 - Cross Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-38295 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMCuppa CMS v1.0 - Cross Site ScriptingCVSS 6.1

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

To remediate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2022cvexsscuppaauthenticatedcuppacmsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
https://github.com/CuppaCMS/CuppaCMS https://nvd.nist.gov/vuln/detail/CVE-2022-38295 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2