PT-2022-25017 · Appsmith · Appsmith

Published 2022-09-05 · Updated 2024-03-06 · CVE-2022-39824

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Appsmith versions through 1.7.14

Description The issue allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget. This can be used to perform Denial of Service (DoS) attacks or achieve an information leak.

Recommendations For Appsmith versions through 1.7.14, as a temporary workaround, consider disabling the list widget or restricting access to the currentItem property until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-APPSMITH-2022-39824

CVE-2022-39824

Affected Products

Appsmith

References · 7

• 🔥 https://github.com/FCncdn/Appsmith-Js-Injection-POC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39824 · Security Note
• https://osv.dev/vulnerability/BIT-appsmith-2022-39824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39824 · Vendor Advisory
• https://github.com/appsmithorg/appsmith/releases · Note
• https://t.me/cvenotify/35946 · Telegram Post
• https://t.me/cibsecurity/49282 · Telegram Post