CVE-2022-48197

Katalog CVE

CVSS 6.1 · Medium EPSS 6,8%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada yui project yui. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Rincian

Terbit di NVD

2 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

6,8% peluang dieksploitasi; lebih tinggi dari 93,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ryan412/CVE-2022-48197/blob/main/README.md advisory pihak ketiga
• https://github.com/yui/yui2/tags advisory pihak ketiga
• http://packetstormsecurity.com/files/171633/Yahoo-User-Interface-TreeView-2.8.2-Cross-Site-Scripting.html
• https://github.com/ryan412/CVE-2022-48197
• https://github.com/yui/yui2/blob/yui2-2.8.2-8/sandbox/treeview/inc-rightbar.php
• https://literatejava.com/security/is-it-really-a-cve-reported-xss-in-yui-2-8-2/