CVE-2022-4560
- Source
- https://cve.org/CVERecord?id=CVE-2022-4560
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4560.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-4560
- Published
- 2022-12-16T00:00:00Z
- Modified
- 2026-10-28T10:31:06Z
- Severity
-
- 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Joget wflow-core UniversalTheme.java getInternalJsCssLib cross site scripting
- Details
-
A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.32 is able to address this issue. The name of the patch is ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215963.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4560.json" }- References
-
- https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4560.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-4560
- https://vuldb.com/?id.215963
- https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b
Affected packages
Git / github.com/jogetworkflow/jw-community
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jogetworkflow/jw-community
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.1" }, { "last_affected": "7.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.2" }, { "last_affected": "7.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.3" }, { "last_affected": "7.0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.4" }, { "last_affected": "7.0.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.5" }, { "last_affected": "7.0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.6" }, { "last_affected": "7.0.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.7" }, { "last_affected": "7.0.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.8" }, { "last_affected": "7.0.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.9" }, { "last_affected": "7.0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.10" }, { "last_affected": "7.0.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.11" }, { "last_affected": "7.0.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.12" }, { "last_affected": "7.0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.13" }, { "last_affected": "7.0.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.14" }, { "last_affected": "7.0.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.15" }, { "last_affected": "7.0.15" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.16" }, { "last_affected": "7.0.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.17" }, { "last_affected": "7.0.17" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.18" }, { "last_affected": "7.0.18" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.19" }, { "last_affected": "7.0.19" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.20" }, { "last_affected": "7.0.20" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.21" }, { "last_affected": "7.0.21" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.22" }, { "last_affected": "7.0.22" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.23" }, { "last_affected": "7.0.23" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.24" }, { "last_affected": "7.0.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.25" }, { "last_affected": "7.0.25" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.26" }, { "last_affected": "7.0.26" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.27" }, { "last_affected": "7.0.27" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.28" }, { "last_affected": "7.0.28" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.29" }, { "last_affected": "7.0.29" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.30" }, { "last_affected": "7.0.30" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "7.0.31" }, { "last_affected": "7.0.31" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "7.0.32", "range": [ { "fixed": "254ea81e5e2fc4ae65bcac3c9a9d193137ef3cbd" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
7.*
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4560.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"158635663726217983472901010059599591465",
"304700672186645028220229901294202004508",
"154225028638014943428219448264973323617",
"115452135249741613689382177106090704388",
"39920110933305863683856645553080535248",
"248728621705195035522041880141370105100",
"144018260183446957013167055879652056461",
"276604849124800141126873294808055252838",
"105422958201307214203121041514184413671",
"211355907841970654497823871580622300312",
"257541133023658505109363042222046124055",
"283076257109992392593952257963602532121",
"278261754573956339442564059383966425445",
"60368975390556120004597297637733737286",
"267332641852798794349677876471974286808",
"259900465866629065033095410673679493628"
],
"threshold": 0.9
},
"id": "CVE-2022-4560-0db03f9e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80711989357200073336713139324831275289",
"186976876015458969349990622683124900203",
"234235377152567471742801999263284965667",
"229473234728104393057885830741042335098"
],
"threshold": 0.9
},
"id": "CVE-2022-4560-2b7bceb7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-core/src/main/java/org/joget/apps/userview/service/UserviewService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "87862307454326551740070970476114945383",
"length": 2377
},
"id": "CVE-2022-4560-71693da7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-consoleweb/src/main/java/org/joget/apps/app/controller/UserviewWebController.java",
"function": "embedView"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "108961901159538210445274541726203846380",
"length": 2292
},
"id": "CVE-2022-4560-dc3f0125",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java",
"function": "getInternalJsCssLib"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201396749292714093805324735882364024323",
"length": 7482
},
"id": "CVE-2022-4560-dcac8222",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-core/src/main/java/org/joget/apps/userview/service/UserviewService.java",
"function": "createUserview"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15130841656643092143819814384924911714",
"95921734899410058779716263774603793439",
"87762279807701402084105201363760883686",
"166663989317632409443893254486705736458"
],
"threshold": 0.9
},
"id": "CVE-2022-4560-f7a5f22c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b",
"target": {
"file": "wflow-consoleweb/src/main/java/org/joget/apps/app/controller/UserviewWebController.java"
}
}
]
vanir_signatures_modified
"2026-10-28T10:31:06Z"