CVE-2022-46151mediumCWE-79

CVE-2022-46151: falha de média gravidade em pinterest querybook

Reflected XSS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar querybook

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
pinterest · querybook
CVEs relacionadas — pinterest querybook

No mesmo produto, das mais perigosas para as menos.

CVE-2024-26148MEDIUMQuerybook's Stored Cross-Site Scripting vulnerability allows Privilege ElevationEPSS 0.5%CVE-2024-27103MEDIUMQuerybook Stored Cross-Site Scripting allows Privilege ElevationEPSS 0.4%CVE-2024-28251MEDIUMCross-site websocket hijacking in QuerybookEPSS 0.2%