CVE-2022-23053
Last modified
CVE-2022-23053 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nasa | Openmct | >= 1.3.0, <= 1.7.7 |
References
- https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934aPatch, Third Party Advisory
- https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934aPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23053?
How severe is CVE-2022-23053?
How do I fix CVE-2022-23053?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23048Exponent CMS 2.6.0patch2 allows an authenticated admin user …7.2
- CVE-2022-23049Exponent CMS 2.6.0patch2 allows an authenticated user to inj…5.4
- CVE-2022-2305The WordPress Popup WordPress plugin through 1.9.3.8 does no…4.8
- CVE-2022-23050ManageEngine AppManager15 (Build No:15510) allows an authent…7.2
- CVE-2022-23051PeteReport Version 0.5 allows an authenticated admin user to…5.4
- CVE-2022-23052PeteReport Version 0.5 contains a Cross Site Request Forgery…6.5
- CVE-2022-23054Openmct versions 1.3.0 to 1.7.7 are vulnerable against store…6.1
- CVE-2022-23055In ERPNext, versions v11.0.0-beta through v13.0.2 are vulner…
- CVE-2022-23056In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vu…
- CVE-2022-23057In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stor…5.4
- CVE-2022-23058ERPNext in versions v12.0.9-v13.0.3 are affected by a stored…
- CVE-2022-23059A Stored Cross Site Scripting (XSS) vulnerability exists in …4.8
Are you affected by CVE-2022-23053?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST