Persistent JavaScript Injection Vulnerability in Exponent CMS by Exponent
CVE-2022-23049

5.4MEDIUM

Key Information:

Vendor

Exponentcms

Status
Exponent Cms
Vendor
CVE Published:
9 February 2022

What is CVE-2022-23049?

A security vulnerability in Exponent CMS 2.6.0patch2 allows authenticated users to inject malicious persistent JavaScript code through the 'User-Agent' header during login. This can lead to session hijacking, as the injected code executes when an administrator visits the 'User Sessions' tab, compromising their session and potentially granting attackers unauthorized access to sensitive administrative functionalities.

Affected Version(s)

Exponent CMS v2.6.0patch2

References

https://github.com/exponentcms/exponent-cms/issues/1546
x_refsource_MISC
https://fluidattacks.com/advisories/cobain/
x_refsource_MISC
https://exponentcms.lighthouseapp.com/projects/61783/tick...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.