CVE-2022-42466

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.

• CWE-79
• CWE-79

• http://www.openwall.com/lists/oss-security/2022/10/19/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/83ftj5jgtv3mbm28w3trjyvd591jztrzMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/10/19/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/83ftj5jgtv3mbm28w3trjyvd591jztrzMailing List, Vendor Advisory

Published

Oct 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42460Broken Access Control vulnerability leading to Stored Cross-…5.4
• CVE-2022-42461Broken Access Control vulnerability in miniOrange's Google A…8.8
• CVE-2022-42462Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ade…4.8
• CVE-2022-42463OpenHarmony-v3.1.2 and prior versions have an authenication …8.8
• CVE-2022-42464OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versi…7.8
• CVE-2022-42465Improper access control in kernel mode driver for the Intel(…6.7
• CVE-2022-42467When running in prototype mode, the h2 webconsole module (ac…5.3
• CVE-2022-42468Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to…9.8
• CVE-2022-42469A permissive list of allowed inputs vulnerability [CWE-183] …4.3
• CVE-2022-4247A vulnerability classified as critical was found in Movie Ti…9.8
• CVE-2022-42470A relative path traversal vulnerability in Fortinet FortiCli…7.8
• CVE-2022-42471An improper neutralization of CRLF sequences in HTTP headers…5.4