CVE-2022-4735 LOW

CVE-2022-4735: asrashley dash-live DOM Node media.js ready cross site scripting

Vendor Asrashley

Product dash-live

Weakness CWE-79 · XSS

Published December 25, 2022

Last update November 19, 2024

View on NVD All CVEs

CVSS base score

3.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.

Key dates

02Disclosure timeline

December 25, 2022 CVE published

November 19, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-4735 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-29795 WordPress Media Cloud for Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean Spaces and more plugin <= 4.5.24 - Cross Site Scripting (XSS) vulnerability CVE-2024-1834 SourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scripting CVE-2025-46979 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-47069 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-6686 Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode