CVE-2022-4520

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.

• CWE-707
• CWE-79

• https://github.com/wso2/carbon-registry/commit/0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4Patch, Third Party Advisory
• https://github.com/wso2/carbon-registry/pull/404Exploit, Patch, Third Party Advisory
• https://github.com/wso2/carbon-registry/releases/tag/v4.8.12Release Notes, Third Party Advisory
• https://vuldb.com/?id.215900Third Party Advisory
• https://github.com/wso2/carbon-registry/commit/0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4Patch, Third Party Advisory
• https://github.com/wso2/carbon-registry/pull/404Exploit, Patch, Third Party Advisory
• https://github.com/wso2/carbon-registry/releases/tag/v4.8.12Release Notes, Third Party Advisory
• https://vuldb.com/?id.215900Third Party Advisory

Published

Dec 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45194CBRN-Analysis before 22 allows XXE attacks via am mws XML do…4.7
• CVE-2022-45195SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, …5.3
• CVE-2022-45196Hyperledger Fabric 2.3 allows attackers to cause a denial of…7.5
• CVE-2022-45197Slixmpp before 1.8.3 lacks SSL Certificate hostname validati…7.5
• CVE-2022-45198Pillow before 9.2.0 performs Improper Handling of Highly Com…7.5
• CVE-2022-45199Pillow before 9.3.0 allows denial of service via SAMPLESPERP…7.5
• CVE-2022-45202GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to con…7.8
• CVE-2022-45204GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to con…5.5
• CVE-2022-45205Jeecg-boot v3.4.3 was discovered to contain a SQL injection …5.3
• CVE-2022-45206Jeecg-boot v3.4.3 was discovered to contain a SQL injection …9.8
• CVE-2022-45207Jeecg-boot v3.4.3 was discovered to contain a SQL injection …9.8
• CVE-2022-45208Jeecg-boot v3.4.3 was discovered to contain a SQL injection …4.3