PT-2022-24834 · Mygraph · Mygraph

Vry3N · Published 2022-09-24 · Updated 2022-09-26 · CVE-2022-39240

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyGraph versions prior to 1.0.4

Description MyGraph is a permission management system that is affected by a storage XSS vulnerability, which can lead to Remote Code Execution.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 to resolve the issue. At the moment, there is no known workaround for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2022-39240

GHSA-HJ4J-923H-927J

Affected Products

Mygraph

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39240.json · Exploit
• 🔥 https://github.com/renlm/MyGraph/security/advisories/GHSA-hj4j-923h-927j · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39240 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39240 · Vendor Advisory
• https://t.me/cibsecurity/50432 · Telegram Post