PT-2022-26955 · Linzhaoguan · Linzhaoguan Pb-Cms

Popko · Published 2022-12-08 · Updated 2024-02-01 · CVE-2022-4353

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LinZhaoguan pb-cms version 2.0

Description A vulnerability has been found in the function IpUtil.getIpAddr, which leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For LinZhaoguan pb-cms version 2.0, consider disabling the IpUtil.getIpAddr function until a patch is available to prevent cross site scripting attacks.

Exploit

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-4353

Affected Products

Linzhaoguan Pb-Cms

References · 6

• 🔥 https://gitee.com/LinZhaoguan/pb-cms/issues/I52422 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4353 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4353 · Vendor Advisory
• https://t.me/cvenotify/39418 · Telegram Post
• https://vuldb.com/?id.215113 · Note
• https://t.me/cvenotify/39412 · Telegram Post