If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
References
| Link | Resource |
|---|---|
| https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ | Exploit Third Party Advisory |
| https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ - Exploit, Third Party Advisory |
07 Nov 2023, 03:56
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality. |
Information
Published : 2023-02-07 22:15
Updated : 2024-11-21 07:31
NVD link : CVE-2022-47414
Mitre link : CVE-2022-47414
CVE.ORG link : CVE-2022-47414
JSON object : View
Products Affected
openkm
- openkm
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')