GHSA-373r-9mg8-3jc4

Source

https://github.com/advisories/GHSA-373r-9mg8-3jc4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-373r-9mg8-3jc4/GHSA-373r-9mg8-3jc4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-373r-9mg8-3jc4

Aliases

CVE-2022-34870

Published

2022-10-25T19:00:27Z

Modified

2023-11-08T04:09:49Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Geode vulnerable to Cross-Site Scripting

Details

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-25T22:40:48Z",
    "nvd_published_at": "2022-10-25T17:15:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.geode:geode-core

Package

Name: org.apache.geode:geode-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.geode/geode-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.15.1

Affected versions

1.*

1.0.0-incubating.M2

1.0.0-incubating.M3

1.0.0-incubating

1.1.0

1.1.1

1.2.0

1.2.1

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

1.9.1

1.9.2

1.10.0

1.11.0

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.15.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-373r-9mg8-3jc4/GHSA-373r-9mg8-3jc4.json"