PT-2022-20668 · Packagist+1 · Idno/Known+1

Phoenix · Published 2022-07-08 · Updated 2022-07-16 · CVE-2022-31290

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Known versions 1.2.2 through 1.3.1

Description A cross-site scripting (XSS) vulnerability allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.

Recommendations For versions 1.2.2 through 1.3.1, consider disabling the Your Name text field until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31290

GHSA-G688-7J3C-H9F3

Affected Products

Idno/Known

Known

References · 9

• 🔥 https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software · Exploit
• https://osv.dev/vulnerability/CVE-2022-31290 · Vendor Advisory
• https://withknown.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31290 · Security Note
• http://docs.withknown.com/en/latest/install/index.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g688-7j3c-h9f3 · Vendor Advisory
• https://github.com/idno/known · Note
• https://t.me/cvenotify/33179 · Telegram Post
• https://t.me/cibsecurity/45804 · Telegram Post