CVE-2022-31133: fallo de gravedad media en humhub
Cross site scripting in HumHub
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.7%
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Productos afectados
humhub · humhubCVEs relacionadas — humhub
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24865MEDIUMImproper access control in humhubEPSS 1.2%CVE-2021-43847MEDIUMAuthorization Bypass in Space Invite in HumHubEPSS 1.2%CVE-2026-47657HIGHHumHub Missing Authorization on Remove All Space Members ActionEPSS 0.4%CVE-2025-64442HIGHHumHub is vulnerable to XSS through its Meta Search componentEPSS 0.2%CVE-2026-29048MEDIUMHumHub: XSS in Button componentEPSS 0.2%
Referencias
https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157caehttps://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959chttps://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76