PT-2022-27671 · Unknown · Planet Estream

Hrvoje Filakovic + 2 · Published 2022-12-25 · Updated 2023-01-04 · CVE-2022-45892

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Planet eStream versions prior to 6.72.10.07

Description The issue involves multiple Stored Cross-Site Scripting (XSS) vulnerabilities in various components, including Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username.

Recommendations For versions prior to 6.72.10.07, update to version 6.72.10.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components, such as the Search Function, Comments, and Content Creation, until a patch is applied. Avoid using the affected features, including Batch editing tool, Related Media, Create new user, and Change Username, until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45892

Affected Products

Planet Estream

References · 5

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream · Exploit
• https://osv.dev/vulnerability/CVE-2022-45892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45892 · Security Note
• https://t.me/cvenotify/40627 · Telegram Post
• https://t.me/cibsecurity/55294 · Telegram Post