medium5.4
CVE-2022-4105
Cross-site Scripting in kiwitcms
Impact
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | kiwitcms | < 11.6 | 11.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kiwitcms | Kiwi Tcms | before 11.6 |