CVE-2022-27920 - Vulnerability Details - OpenCVE

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Fedora
Kiwix	Libkiwix

Configuration 1 [-]

OR	cpe:2.3:a:kiwix:libkiwix:10.0.0:::::::*
	cpe:2.3:a:kiwix:libkiwix:10.0.1:::::::*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/kiwix/libkiwix/issues/728
https://github.com/kiwix/libkiwix/pull/721
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-25T20:00:38

Updated: 2024-08-03T05:41:10.779Z

Reserved: 2022-03-25T00:00:00

Link: CVE-2022-27920

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-03-25T20:15:09.317

Modified: 2024-11-21T06:56:28.153

Link: CVE-2022-27920

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-04T03:06:06", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/kiwix/libkiwix/pull/721"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kiwix/libkiwix/issues/728"}, {"name": "FEDORA-2022-d0fe2a444a", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-27920", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/kiwix/libkiwix/pull/721", "refsource": "MISC", "url": "https://github.com/kiwix/libkiwix/pull/721"}, {"name": "https://github.com/kiwix/libkiwix/issues/728", "refsource": "MISC", "url": "https://github.com/kiwix/libkiwix/issues/728"}, {"name": "FEDORA-2022-d0fe2a444a", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:41:10.779Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kiwix/libkiwix/pull/721"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kiwix/libkiwix/issues/728"}, {"name": "FEDORA-2022-d0fe2a444a", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-27920", "datePublished": "2022-03-25T20:00:38", "dateReserved": "2022-03-25T00:00:00", "dateUpdated": "2024-08-03T05:41:10.779Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kiwix:libkiwix:10.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2D6053B-20D1-4863-B01F-A7C819471B29", "vulnerable": true}, {"criteria": "cpe:2.3:a:kiwix:libkiwix:10.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E1B852DD-2B94-4EA3-8ADC-92C7DEED4328", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0."}, {"lang": "es", "value": "libkiwix versiones 10.0.0 y 10.0.1, permite una vulnerabilidad de tipo XSS en la funcionalidad del servidor web integrado por medio del par\u00e1metro URL de sugerencias de b\u00fasqueda. Esto ha sido corregido en versi\u00f3n 10.1.0"}], "id": "CVE-2022-27920", "lastModified": "2024-11-21T06:56:28.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-03-25T20:15:09.317", "references": [{"source": "[email protected]", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/kiwix/libkiwix/issues/728"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/kiwix/libkiwix/pull/721"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/kiwix/libkiwix/issues/728"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/kiwix/libkiwix/pull/721"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KD4KX5N2PGMIOQR2IZWEUTZCCTPWU3EJ/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}