PT-2022-17054 · Htmly · Htmly

Moritz Huppert · Published 2022-03-01 · Updated 2022-03-09 · CVE-2022-25022

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Htmly version 2.8.1

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts via a crafted payload in the content field of a blog post. This enables the execution of malicious HTML code.

Recommendations For Htmly version 2.8.1, consider disabling the blog post feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the content field to minimize the risk of malicious payload injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-25022

Affected Products

Htmly

References · 9

• 🔥 https://github.com/MoritzHuppert/CVE-2022-25022/blob/main/CVE-2022-25022.pdf · Exploit
• 🔥 https://youtu.be/acookTqf3Nc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25022 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25022 · Vendor Advisory
• https://t.me/cibsecurity/38239 · Telegram Post
• http://htmly.com · Note
• https://t.me/cvenotify/27946 · Telegram Post
• https://cvedetails.com/cve/CVE-2021-36703 · Note
• http://danpros.com · Note