Description

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

Remediation

References

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602

Related Vulnerabilities

CVE-2022-42123 Vulnerability in maven package com.liferay:com.liferay.portal.search.elasticsearch7.impl

CVE-2020-13949 Vulnerability in maven package org.apache.thrift:libthrift

CVE-2023-32697 Vulnerability in maven package org.xerial:sqlite-jdbc

CVE-2020-16044 Vulnerability in npm package electron

CVE-2023-29525 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui

Severity

Medium

Classification

CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Vendor Advisory