« Volver al listado

CVE-2022-27910

Estado: ModificadaMedia (6.1)—

In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Joomlatools — Docman

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-27910",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@joomla.org",
      "affectedData": [
        {
          "vendor": "Joomlatools",
          "product": "DOCman",
          "versions": [
            {
              "status": "affected",
              "version": "<=3.5.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-10T20:15:13.073",
  "references": [
    {
      "url": "https://www.joomlatools.com/extensions/docman/changelog/3.5.14",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@joomla.org"
    },
    {
      "url": "https://www.joomlatools.com/extensions/docman/changelog/3.5.14",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function"
    },
    {
      "lang": "es",
      "value": "En el componente de Joomla \"Joomlatools - DOCman versiones 3.5.13 (y probablemente la mayoría de versiones anteriores)\" están afectados por un ataque de tipo Cross-Site Scripting (XSS) reflejado en una función image upload"
    }
  ],
  "lastModified": "2026-06-17T04:37:43.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:joomlatools:docman:*:*:*:*:*:joomla\\!:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94917ED7-7524-435C-9469-25A1D133B449",
              "versionEndExcluding": "3.5.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@joomla.org"
}