Joget ଯେପର୍ଯ୍ୟନ୍ତ 7.0.31 wflow-core UniversalTheme.java getInternalJsCssLib key କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ

Rakkoon nageenyaa kan ସମସ୍ୟାଜନକ jedhamuun beekamu Joget ଯେପର୍ଯ୍ୟନ୍ତ 7.0.31 keessatti argameera. Miidhamni argame is hojii getInternalJsCssLib faayilii wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java keessa kutaa wflow-core keessa. Wanti jijjiirame irratti key gara କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ geessa. Rakkoo ibsuuf CWE yoo fayyadamte gara CWE-79 si geessa. Odeeffannoon kun yeroo 12/16/2022 maxxanfameera akka ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. Odeeffannoon kun buufachuuf github.com irratti argama. Dogoggorri kun CVE-2022-4560 jedhamee waamama. Weerara fageenya irraa jalqabuu ni danda'ama. Ibsa teeknikaa ni jira. Meeshaa balaa kana fayyadamuuf hin jirre. Ammas, gatii exploit might be approx. USD $0-$5k yeroo ammaa irratti argamuu danda'a. ଅପରିଭାଷିତ ta’uu isaa ibsameera. Akka 0-daytti, gatiin isaa daldala dhoksaa keessatti $0-$5k akka ta'e tilmaamameera. Idaantifayarii paachii ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b dha. Sirreeffamni rakkoo github.com irratti buufachuuf jira. Qabiyyee miidhamte haaromsuuf gorsa ni kennama. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

4 ଆଡାପ୍ଟେସନ୍ · 71 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
12/16/2022 03:39 PM		ଅଦ୍ୟତନ 1/3
12/24/2022 05:43 PM		ଅଦ୍ୟତନ 2/3
01/13/2023 01:26 PM		ଅଦ୍ୟତନ 3/3
01/13/2023 01:31 PM
software_nameJogetJogetJogetJoget
software_version<=7.0.32<=7.0.31<=7.0.31<=7.0.31
software_componentwflow-corewflow-corewflow-corewflow-core
software_filewflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.javawflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.javawflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.javawflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java
software_functiongetInternalJsCssLibgetInternalJsCssLibgetInternalJsCssLibgetInternalJsCssLib
software_argumentkeykeykeykey
vulnerability_cweCWE-79 (କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ)CWE-79 (କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ)CWE-79 (କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ)CWE-79 (କ୍ରସ୍ ସାଇଟ୍ ସ୍କ୍ରିପ୍ଟିଂ)
vulnerability_risk1111
cvss3_vuldb_avNNNN
cvss3_vuldb_acLLLL
cvss3_vuldb_uiRRRR
cvss3_vuldb_sUUUU
cvss3_vuldb_cNNNN
cvss3_vuldb_iLLLL
cvss3_vuldb_aNNNN
cvss3_vuldb_rlOOOO
cvss3_vuldb_rcCCCC
advisory_identifierecf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1b
advisory_urlhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b
countermeasure_nameଅପଗ୍ରେଡ୍ କରନ୍ତୁଅପଗ୍ରେଡ୍ କରନ୍ତୁଅପଗ୍ରେଡ୍ କରନ୍ତୁଅପଗ୍ରେଡ୍ କରନ୍ତୁ
upgrade_version8.0-BETA7.0.327.0.327.0.32
countermeasure_upgrade_urlhttps://github.com/jogetworkflow/jw-community/releases/tag/8.0-BETAhttps://github.com/jogetworkflow/jw-community/releases/tag/7.0.32https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32
patch_nameecf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1becf8be8f6f0cb725c18536ddc726d42a11bdaa1b
countermeasure_patch_urlhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bhttps://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b
source_cveCVE-2022-4560CVE-2022-4560CVE-2022-4560CVE-2022-4560
cna_responsibleVulDBVulDBVulDBVulDB
advisory_date1671145200 (12/16/2022)1671145200 (12/16/2022)1671145200 (12/16/2022)1671145200 (12/16/2022)
cvss2_vuldb_avNNNN
cvss2_vuldb_acLLLL
cvss2_vuldb_ciNNNN
cvss2_vuldb_iiPPPP
cvss2_vuldb_aiNNNN
cvss2_vuldb_rcCCCC
cvss2_vuldb_rlOFOFOFOF
cvss2_vuldb_auSSSS
cvss2_vuldb_eNDNDNDND
cvss3_vuldb_prLLLL
cvss3_vuldb_eXXXX
cvss2_vuldb_basescore4.04.04.04.0
cvss2_vuldb_tempscore3.53.53.53.5
cvss3_vuldb_basescore3.53.53.53.5
cvss3_vuldb_tempscore3.43.43.43.4
cvss3_meta_basescore3.53.53.54.4
cvss3_meta_tempscore3.43.43.44.3
price_0day$0-$5k$0-$5k$0-$5k$0-$5k
cve_assigned1671145200 (12/16/2022)1671145200 (12/16/2022)
cve_nvd_summaryA vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.32 is able to address this issue. The name of the patch is ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215963.A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.32 is able to address this issue. The name of the patch is ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215963.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiR
cvss3_nvd_sC
cvss3_nvd_cL
cvss3_nvd_iL
cvss3_nvd_aN
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iL
cvss3_cna_aN
cve_cnaVulDB
cvss3_nvd_basescore6.1
cvss3_cna_basescore3.5

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!