CVE-2022-3895
MEDIUMCVSS 6.1/10EPSS 0.27%
Last modified
CVE-2022-3895 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hallowelt | Bluespice | >= 4.1.0, < 4.2.1 |
| Hallowelt | Common User Interface | >= 3.0.0, < 3.0.5 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3895?
Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).
How severe is CVE-2022-3895?
CVE-2022-3895 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.27% probability of exploitation in the next 30 days.
How do I fix CVE-2022-3895?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38934readelf in ToaruOS 2.0.1 has some arbitrary address read vul…3.3
- CVE-2022-38935An issue was discovered in NiterForum version 2.5.0-beta in …8.8
- CVE-2022-38936An issue has been found in PBC through 2022-8-27. A SEGV iss…7.5
- CVE-2022-3894The WP OAuth Server (OAuth Authentication) WordPress plugin …4.3
- CVE-2022-38946Arbitrary File Upload vulnerability in Doctor-Appointment ve…9.8
- CVE-2022-38947SQL Injection vulnerability in Flipkart-Clone-PHP version 1.…9.8
- CVE-2022-38955An exploitable firmware modification vulnerability was disco…7.5
- CVE-2022-38956An exploitable firmware downgrade vulnerability was discover…5.3
- CVE-2022-3896The WP Affiliate Platform plugin for WordPress is vulnerable…6.1
- CVE-2022-3897The WP Affiliate Platform plugin for WordPress is vulnerable…4.8
- CVE-2022-38970ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrec…6.5
- CVE-2022-38971Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraf…5.4
Are you affected by CVE-2022-3895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST