Stored XSS in MITRE CALDERA 4.1.0 Product
CVE-2022-41139

5.4MEDIUM

Key Information:

Vendor

Mitre

Status
Caldera
Vendor
CVE Published:
17 October 2022

What is CVE-2022-41139?

MITRE CALDERA version 4.1.0 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability through the app.contact.gist field. This flaw allows an attacker to inject malicious scripts that may execute arbitrary commands on the agents, posing significant risks to the integrity and confidentiality of the system. Ensuring that proper input validation and output sanitization measures are implemented is crucial to mitigate this vulnerability.

References

https://github.com/metaredteam/external-disclosures/secur...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.