PT-2022-20553 · Humhub · Humhub

Luke-Published · Published 2022-07-07 · Updated 2022-07-14 · CVE-2022-31133

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HumHub versions prior to 1.11.4 HumHub versions prior to 1.10.5

Description HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped, and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space.

Recommendations For versions prior to 1.11.4, upgrade to 1.11.4. For versions prior to 1.10.5, upgrade to 1.10.5. As a temporary workaround, consider restricting access to the Spaces feature until a patch is available. Avoid using the space name variable in the affected feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31133

GHSA-P7H3-73V7-959C

Affected Products

Humhub

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31133.json · Exploit
• https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1 · Patch
• https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157cae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31133 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31133 · Vendor Advisory
• https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959c · Note
• https://t.me/cibsecurity/45764 · Telegram Post
• https://t.me/cvenotify/33096 · Telegram Post
• https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76 · Note