PT-2023-15911 · Exo · Exo Chat Application

Published 2023-02-06 · Updated 2024-05-17 · CVE-2022-4902

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions eXo Chat Application versions prior to 3.3.0-20220417

Description A problematic issue has been found in the eXo Chat Application, affecting an unknown function of the Mention Handler component in the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue. This issue leads to cross-site scripting and can be launched remotely.

Recommendations For versions prior to 3.3.0-20220417, upgrade to version 3.3.0-20220417 to address this issue. As a temporary workaround, consider restricting access to the Mention Handler component until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-4902

Affected Products

Exo Chat Application

References · 8

• https://github.com/exoplatform/chat-application/releases/tag/3.3.0-20220417 · Patch
• https://github.com/exoplatform/chat-application/commit/26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc · Patch
• https://github.com/exoplatform/chat-application/pull/485 · Patch
• https://osv.dev/vulnerability/CVE-2022-4902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4902 · Security Note
• https://community.exoplatform.com/portal/dw/tasks/taskDetail/56304 · Vendor Advisory
• https://vuldb.com/?id.220212 · Note
• https://vuldb.com/?ctiid.220212 · Note