Vulnerability Description
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Humhub | Humhub | < 1.10.5 |
Related Weaknesses (CWE)
References
- https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157caePatchThird Party Advisory
- https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1PatchThird Party Advisory
- https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959cThird Party Advisory
- https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76Not Applicable
- https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157caePatchThird Party Advisory
- https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1PatchThird Party Advisory
- https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959cThird Party Advisory
- https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76Not Applicable
FAQ
What is CVE-2022-31133?
CVE-2022-31133 is a vulnerability with a CVSS score of 5.9 (MEDIUM). HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permiss...
How severe is CVE-2022-31133?
CVE-2022-31133 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31133?
Check the references section above for vendor advisories and patch information. Affected products include: Humhub Humhub.