CVE-2022-23053 MEDIUM

CVE-2022-23053: Openmct XSS via the “Condition Widget”

Vendor Nasa

Product openmct

Weakness CWE-79 · XSS

Published February 20, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.

Key dates

02Disclosure timeline

February 20, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-23053 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

Identifiers

CVE CVE-2022-23053

CWE CWE-79

CVSS 6.1 / MEDIUM

Affected versions

Vendor Nasa

Product openmct

Affected ≥ 1.7.7 and ≤ 1.7.7

Vendor Nasa

Product openmct

Affected ≥ 1.3.0 and < 1.3.0*

CVE-2022-23053: Openmct XSS via the “Condition Widget”

01Description

02Disclosure timeline

03References

04Related CVE