XSS Vulnerability in MITRE CALDERA Operations Tab and Debrief Plugin
CVE-2022-40605

6.1MEDIUM

Key Information:

Vendor

Mitre

Status
Caldera
Vendor
CVE Published:
17 October 2022

What is CVE-2022-40605?

MITRE CALDERA versions before 4.1.0 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited through crafted operation names in the Operations tab and/or the Debrief plugin. This flaw may allow attackers to execute malicious scripts in the context of a user, posing significant risks to web application security and user data.

References

https://github.com/mitre/caldera/releases/tag/4.1.0

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.