CVE-2022-30278

A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/	Vendor Advisory
https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:synopsys:black_duck_hub:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:02

Type	Values Removed	Values Added
References	~~() https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/ - Vendor Advisory~~	() https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/ - Vendor Advisory

Information

Published : 2022-05-10 20:15

Updated : 2024-11-21 07:02

NVD link : CVE-2022-30278

Mitre link : CVE-2022-30278

CVE.ORG link : CVE-2022-30278

JSON object : View

Products Affected

synopsys

black_duck_hub

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-30278", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-05-10T20:15:09.827", "references": [{"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/", "tags": ["Vendor Advisory"], "source": "disclosure@synopsys.com"}, {"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Black Duck Hub\u2019s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information."}, {"lang": "es", "value": "Una vulnerabilidad en los archivos de documentaci\u00f3n de MadCap Flare insertados en Black Duck Hub podr\u00eda permitir a un atacante remoto no autenticado realizar un ataque de tipo cross-site scripting. La vulnerabilidad es debido a que no ha sido comprobada apropiadamente la entrada suministrada por el usuario al marco de MadCap Flare insertado en la documentaci\u00f3n de ayuda de Black Duck Hub para suministrar contenido. Un atacante podr\u00eda explotar esta vulnerabilidad al convencer a un usuario para que haga clic en un enlace dise\u00f1ado para pasar una entrada maliciosa a la interfaz. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conducir ataques de tipo cross-site scripting y conseguir acceso a informaci\u00f3n confidencial basada en el navegador"}], "lastModified": "2024-11-21T07:02:29.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:synopsys:black_duck_hub:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34F9EDE0-676C-4404-A79D-77FB2A89C6B9", "versionEndExcluding": "2022.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@synopsys.com"}