PT-2022-26681 · Equalweb · Equalweb Accessibility Widget

Published 2022-11-16 · Updated 2022-11-21 · CVE-2022-42960

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EqualWeb Accessibility Widget versions 2.0.0 through 4.0.1

Description The issue is related to DOM XSS due to improper validation of message events to accessibility.js. This allows for potential exploitation.

Recommendations For versions 2.0.0 through 4.0.1, consider disabling the accessibility.js file until a patch is available to prevent DOM XSS exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42960

Affected Products

Equalweb Accessibility Widget

References · 4

• https://osv.dev/vulnerability/CVE-2022-42960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42960 · Security Note
• https://imperva.com/blog/vulnerability-discovered-in-equalweb-accessibility-widget · Note
• https://t.me/cvenotify/38167 · Telegram Post