PT-2022-28145 · Joget · Joget

Published 2022-12-30 · Updated 2024-05-17 · CVE-2022-4859

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joget versions up to 7.0.33

Description A problematic issue has been found in Joget, affecting the submitForm function of the UserProfileMenu component. The manipulation of the firstName/lastName arguments leads to cross-site scripting. The attack can be initiated remotely. Upgrading to version 7.0.34 addresses this issue.

Recommendations For Joget versions up to 7.0.33, upgrade to version 7.0.34 to address the issue. As a temporary workaround, consider restricting the use of the submitForm function in the UserProfileMenu component until the patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4859

Affected Products

Joget

References · 10

• https://github.com/jogetworkflow/jw-community/commit/9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8 · Patch
• https://github.com/jogetworkflow/jw-community/releases/tag/7.0.34 · Patch
• https://osv.dev/vulnerability/CVE-2022-4859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4859 · Security Note
• https://t.me/cvenotify/41423 · Telegram Post
• https://t.me/cvenotify/60152 · Telegram Post
• https://vuldb.com/?ctiid.217055 · Note
• https://t.me/cvenotify/41006 · Telegram Post
• https://vuldb.com/?id.217055 · Note
• https://t.me/cibsecurity/55561 · Telegram Post