PT-2022-13938 · Automad · Automad

Xiahao90 · Published 2022-04-29 · Updated 2022-05-11 · CVE-2022-1536

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions automad versions up to 1.10.9

Description A problematic issue has been found in the Dashboard, where the manipulation of the title argument with a specific input, such as Home</title><script>alert("home")</script><title>, leads to a cross-site scripting issue. The attack can be initiated remotely but requires authentication. The details of the exploit have been disclosed to the public and may be used.

Recommendations For versions up to 1.10.9, consider disabling the Dashboard or restricting access to it until a patch is available. As a temporary workaround, avoid using the title argument in the affected area to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1536

Affected Products

Automad

References · 6

• 🔥 https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting(XSS).md · Exploit
• 🔥 https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-1536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1536 · Security Note
• https://t.me/cibsecurity/41629 · Telegram Post
• https://vuldb.com/?id.198706 · Note