CVE-2022-32173

OrchardCore - HTML Injection

In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.

Affected

OrchardCore

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.65% chance of exploitation in the next 30 days, 50th percentile

Published

2022-10-03

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://www.mend.io/vulnerability-database/CVE-2022-32173

Security advisories

• OrchardCMS/OrchardCore/commit/0163c88ddeaca39815d7e6e5ea1c8391085cc136
• advisories/GHSA-5gg9-gwj4-mqmj

References

• CVE Record
• NVD entry