CVE-2022-3893 LOW

CVE-2022-3893: Potential XSS on custom menu navigation

Vendor Hallo Welt! Gmbh

Product BlueSpice

Weakness CWE-79 · XSS

Published November 15, 2022

Last update April 29, 2025

View on NVD All CVEs

CVSS base score

2.3/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.

Key dates

02Disclosure timeline

November 15, 2022 CVE published

April 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3893 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-11737 VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title CVE-2023-0519 Cross-site Scripting (XSS) - Stored in modoboa/modoboa CVE-2022-44591 WordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability CVE-2026-39604 WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability CVE-2023-44230 WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)