The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.
References
| Link | Resource |
|---|---|
| https://github.com/afine-com/CVE-2022-36433 | Exploit Third Party Advisory |
| https://weglow.ski | Not Applicable |
| https://github.com/afine-com/CVE-2022-36433 | Exploit Third Party Advisory |
| https://weglow.ski | Not Applicable |
Configurations
History
21 Nov 2024, 07:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/afine-com/CVE-2022-36433 - Exploit, Third Party Advisory | |
| References | () https://weglow.ski - Not Applicable |
01 Dec 2022, 21:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:amasty:amasty_blog_pro:*:*:*:*:*:magento_2:*:* | |
| CWE | CWE-79 | |
| References | (MISC) https://weglow.ski - Not Applicable | |
| References | (MISC) https://github.com/afine-com/CVE-2022-36433 - Exploit, Third Party Advisory |
29 Nov 2022, 13:57
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-29 13:15
Updated : 2024-11-21 07:12
NVD link : CVE-2022-36433
Mitre link : CVE-2022-36433
CVE.ORG link : CVE-2022-36433
JSON object : View
Products Affected
amasty
- amasty_blog_pro
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')