CVE-2022-2510 MEDIUM

CVE-2022-2510: Potential XSS on Special:SearchCenter

Vendor Hallo Welt! Gmbh
Product BlueSpice
Weakness CWE-79 · XSS
Published July 22, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.

Key dates

02Disclosure timeline

July 22, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-21807 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability CVE-2023-45064 WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2025-48266 WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.8 - Cross Site Scripting (XSS) Vulnerability CVE-2023-2427 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq CVE-2023-28852 GLPI vulnerable to stored Cross-site Scripting through dashboard administration