CVE-2022-46151
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-46151
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46151.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-46151
- Related
- Published
- 2022-12-06T01:15:09Z
- Modified
- 2025-01-15T04:00:29.969615Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in
querybook/server/app/auth/oauth_auth.pyandquerybook/server/app/auth/okta_auth.py. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled orunsafe-inlineis allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy. - References