PT-2022-27864 · Tatoeba2 · Tatoeba2

Pineapplesnackz · Published 2022-12-21 · Updated 2022-12-29 · CVE-2022-4642

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tatoeba2 versions prior to prod 2022-10-30

Description A vulnerability was found in the Profile Name Handler component of tatoeba2, which can lead to cross site scripting. The manipulation can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For versions prior to prod 2022-10-30, upgrade to version prod 2022-10-30 to address this issue. As a temporary workaround, consider restricting access to the Profile Name Handler component until the upgrade is applied.

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-4642

Affected Products

Tatoeba2

References · 8

• https://github.com/Tatoeba/tatoeba2/issues/3002 · Patch
• https://github.com/Tatoeba/tatoeba2/commit/91110777fc8ddf1b4a2cf4e66e67db69b9700361 · Patch
• https://osv.dev/vulnerability/CVE-2022-4642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4642 · Security Note
• https://github.com/Tatoeba/tatoeba2/releases/tag/prod_2022-10-30 · Note
• https://vuldb.com/?id.216501 · Note
• https://t.me/cvenotify/40941 · Telegram Post
• https://t.me/cibsecurity/55091 · Telegram Post