PT-2022-25403 · Unknown · Processwire

Filipe Azevedo + 1 · Published 2022-10-31 · Updated 2022-11-01 · CVE-2022-40487

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProcessWire version 3.0.200

Description The issue allows attackers to execute arbitrary web scripts or HTML via injection of a crafted payload, leveraging multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities are specifically found in the Search Users and Search Pages function.

Recommendations For version 3.0.200, consider disabling the Search Users and Search Pages functions until a patch is available to prevent exploitation of the XSS vulnerabilities. Restrict access to these functions to minimize the risk of arbitrary web script or HTML execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40487

GHSA-8G35-PRRR-GXXF

Affected Products

Processwire

References · 6

• http://processwire.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40487 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g35-prrr-gxxf · Vendor Advisory
• https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-40487 · Security Note
• https://github.com/processwire/processwire · Note