PT-2022-24050 · Unknown · Project Wonder Webobjects

Notsoanonimus · Published 2022-09-14 · Updated 2022-09-19 · CVE-2022-37724

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Project Wonder WebObjects versions 1.0 through 7.3

Description The issue concerns Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available.

Recommendations For Project Wonder WebObjects versions 1.0 through 7.3, apply the patch available at commit number b0d2d74f13203268ea254b02552600850f28014b to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37724

GHSA-XV7R-9VQ4-9WRQ

Affected Products

Project Wonder Webobjects

References · 7

• 🔥 https://xmit.xyz/security/webobjects-url-tomfoolery · Exploit
• https://github.com/wocommunity/wonder/pull/992 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-37724 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37724 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv7r-9vq4-9wrq · Vendor Advisory
• https://github.com/wocommunity/wonder · Note
• https://github.com/wocommunity/wonder/commit/b0d2d74f13203268ea254b02552600850f28014b · Note