CVE-2022-31136

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-31136

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31136.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-31136

Aliases

GHSA-2cfh-v7rf-pxfp

Published

2022-07-07T17:55:13Z

Modified

2026-08-12T03:51:23.627873202Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Cross-site Scripting in BookWyrm

Details

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31136.json"
}

References

Affected packages

Git / github.com/bookwyrm-social/bookwyrm

Affected ranges

Type

GIT

Repo

https://github.com/bookwyrm-social/bookwyrm

Events

Introduced

Fixed

e452aa95b658fbb9672f746185488b10a1114f14

Fixed

fe33fdcf564a6a5667aef75d5456bea08feab50d

Database specific

Show details

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:joinbookwyrm:bookwyrm:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.1"
        }
    ]
}

Affected versions

v0.*

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31136.json"