CVE-2022-39824

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39824
Aliases
Published
2022-09-05T02:54:02Z
Modified
2026-07-15T01:49:05.059493061Z
Summary
[none]
Details

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39824.json"
}
References

Affected packages

Git / github.com/appsmithorg/appsmith

Affected ranges

Type
GIT
Repo
https://github.com/appsmithorg/appsmith
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ead20ac5ea296c11c8ec965d0f456e61dd029a0
Database specific 
{
    "cpe": "cpe:2.3:a:appsmith:appsmith:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.14"
        },
        {
            "last_affected": "1.7.14"
        }
    ],
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ]
}

Affected versions

v.*
v.1.6.23
v.1.6.25
v1.*
v1.0
v1.0-beta.2
v1.0.1
v1.0.2
v1.1
v1.2
v1.2.1
v1.2.16
v1.2.2
v1.2.4
v1.4.3
v1.4.4
v1.5.17
v1.6.10
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.15
v1.6.16
v1.6.17
v1.6.18
v1.6.19
v1.6.20
v1.6.21
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39824.json"