CVE-2022-4927

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-4927
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4927.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-4927
Published
2023-03-05T20:00:05.181Z
Modified
2026-07-15T01:49:15.754353062Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing
Details

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be initiated remotely. Upgrading to version 1.0.71 is able to address this issue. The patch is named abe9f57123e0c278ae190cd7402a623d66c51375. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222287.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4927.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1022"
    ]
}
References

Affected packages

Git / github.com/ualbertalib/neosdiscovery

Affected ranges

Type
GIT
Repo
https://github.com/ualbertalib/neosdiscovery
Events
Introduced
aa504d662811c98d1c334af31348812912cc1ee2
Fixed
abe9f57123e0c278ae190cd7402a623d66c51375
Fixed
b7a3c6ad1ac66b0b0f197b642eb8b7d4f98922de
Database specific 
{
    "cpe": "cpe:2.3:a:ualberta:neosdiscovery:1.0.70:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.70"
        },
        {
            "last_affected": "1.0.70"
        }
    ]
}

Affected versions

1.*
1.0.70

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-4927.json"