CVE-2022-37720 — CRITICAL (9.0)

Vulnerability Description

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.

CVSS Score

9.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Orchardcore	Orchard Cms	1.10.3

Related Weaknesses (CWE)

CWE-79

References

http://orchard.comProduct
http://orchardproject.comProduct
https://labs.integrity.pt/advisories/cve-2022-37720/ExploitThird Party Advisory
http://orchard.comProduct
http://orchardproject.comProduct
https://labs.integrity.pt/advisories/cve-2022-37720/ExploitThird Party Advisory

FAQ

What is CVE-2022-37720?

CVE-2022-37720 is a vulnerability with a CVSS score of 9.0 (CRITICAL). Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, ...

How severe is CVE-2022-37720?

CVE-2022-37720 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-37720?

Check the references section above for vendor advisories and patch information. Affected products include: Orchardcore Orchard Cms.