PT-2022-25572 · Unknown · Ndkadvancedcustomizationfields

Dalii · Published 2022-12-21 · Updated 2024-02-14 · CVE-2022-40841

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NdkAdvancedCustomizationFields version 3.5.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the htmlNodes parameter. This enables attackers to potentially manipulate web page content or steal user data.

Recommendations For NdkAdvancedCustomizationFields version 3.5.0, consider disabling the use of the htmlNodes parameter until a patch is available to prevent exploitation. Restrict access to areas of the application where this parameter is used to minimize the risk of XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-40841

Affected Products

Ndkadvancedcustomizationfields

References · 6

• 🔥 https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40841/poc.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-40841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40841 · Security Note
• http://ndkadvancedcustomizationfields.com · Note
• https://t.me/cibsecurity/55059 · Telegram Post
• https://t.me/cvenotify/40370 · Telegram Post