PT-2022-16820 · Weblate · Weblate

Nijel · Published 2022-02-25 · Updated 2024-06-15 · CVE-2022-24710

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 4.11

Description Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization, it is possible to perform cross-site scripting via these fields.

Recommendations For versions prior to 4.11, users are advised to add their own neutralize logic to prevent cross-site scripting attacks. As a temporary workaround, consider adding input validation for user name and language fields until a patch is available. For users who can upgrade, the issues were fixed in the 4.11 release.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-WEBLATE-2022-24710

CVE-2022-24710

GHSA-6JP6-9RF9-GC66

OPENSUSE-SU-2024:11887-1

PYSEC-2022-35

Affected Products

Weblate

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24710.json · Exploit
• https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bda · Patch
• https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389 · Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66 · Patch
• https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24710 · Security Note
• https://osv.dev/vulnerability/GHSA-6jp6-9rf9-gc66 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11887-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-weblate-2022-24710 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-35 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24710 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-35.yaml · Note
• https://suse.com/security/cve/CVE-2022-24710 · Note
• https://t.me/cvenotify/27407 · Telegram Post