CVE-2022-43706

{"id": "CVE-2022-43706", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-12-05T23:15:09.757", "references": [{"url": "https://stackstorm.com/2022/12/v3-8-0-released/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users."}, {"lang": "es", "value": "La vulnerabilidad de Cross-Site Scripting (XSS) en la interfaz de usuario web de las versiones de StackStorm anteriores a la 3.8.0 permit\u00eda a los usuarios registrados con acceso de escritura para empaquetar reglas para inyectar scripts arbitrarios o HTML que pueden ejecutarse en la interfaz de usuario web para otros usuarios conectados."}], "lastModified": "2022-12-06T20:33:40.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stackstorm:stackstorm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4ED2DBF-F4D1-4C29-9F9C-0253326ABEA7", "versionEndExcluding": "3.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}