PT-2023-15914 · Unknown · Ualbertalib Neosdiscovery

Published 2023-03-05 · Updated 2024-05-17 · CVE-2022-4927

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ualbertalib NEOSDiscovery version 1.0.70

Description This issue affects some unknown processing of the file app/views/bookmarks/ refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be initiated remotely.

Recommendations For version 1.0.70, upgrade to version 1.0.71 to address this issue. As a temporary workaround, consider restricting access to the file app/views/bookmarks/ refworks.html.erb until the upgrade is applied.

Fix

Weakness Enumeration

CWE-1022

Related Identifiers

CVE-2022-4927

Affected Products

Ualbertalib Neosdiscovery

References · 9

• https://github.com/ualbertalib/NEOSDiscovery/commit/abe9f57123e0c278ae190cd7402a623d66c51375 · Patch
• https://github.com/ualbertalib/NEOSDiscovery/pull/547 · Patch
• https://github.com/ualbertalib/NEOSDiscovery/releases/tag/1.0.71 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4927 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4927 · Vendor Advisory
• https://vuldb.com/?ctiid.222287 · Note
• https://t.me/cibsecurity/59434 · Telegram Post
• https://t.me/cvenotify/45544 · Telegram Post
• https://vuldb.com/?id.222287 · Note