« Volver al listado

CVE-2022-30429

Estado: ModificadaMedia (5.4)—

Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Neos — Neos CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-30429",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-02T18:15:09.717",
  "references": [
    {
      "url": "https://it-sec.de/unbekannte-schwachstellen-in-neos-cms/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.neos.io/blog/xss-in-various-backend-modules.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://it-sec.de/unbekannte-schwachstellen-in-neos-cms/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.neos.io/blog/xss-in-various-backend-modules.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Neos CMS permiten a atacantes con el rol de editor o superior inyectar secuencias de comandos arbitrarias o código HTML usando la función de editor, la eliminación de activos o un título de espacio de trabajo. Las vulnerabilidades fueron encontradas en versiones 3.3.29 y 8.0.1 y también podrían estar presentes en todas las versiones intermedias"
    }
  ],
  "lastModified": "2026-06-17T04:43:39.523",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "647DA60C-5595-43B1-B88D-BFB82ECC1FD1",
              "versionEndExcluding": "5.3.10",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B7A1D64-3C86-49DA-BF78-ACE335BCE86F",
              "versionEndExcluding": "7.0.9",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E148620F-6F01-4D5F-B13B-30FE2DD73A04",
              "versionEndExcluding": "7.1.7",
              "versionStartIncluding": "7.1.0"
            },
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A84DF9A-DD28-48A9-8E3C-2C0A77339768",
              "versionEndExcluding": "7.2.6",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B7C5C66-D3AB-4785-8A65-97C672ADAA6D",
              "versionEndExcluding": "7.3.4",
              "versionStartIncluding": "7.3.0"
            },
            {
              "criteria": "cpe:2.3:a:neos:neos_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F294F8DD-6872-4275-9075-4A7408F2D170",
              "versionEndExcluding": "8.0.2",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}