« Volver al listado

CVE-2022-39301

Estado: ModificadaMedia (5.4)—

sra-admin es un sistema de administración de derechos en segundo plano que separa el front y el back end. La versión 1.1.1 de sra-admin presenta una vulnerabilidad de tipo cross-site scripting (XSS) de almacenamiento. Después de iniciar sesión en el fondo de sra-admin, un atacante puede descargar una página html que contenga código de ataque de tipo xss en "Personal Center" - "Profile Picture Upload", lo que permite el robo de la información personal del usuario. Este problema ha sido parcheado en la versión 1.1.2. No se presentan mitigaciones conocidas

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sra-admin Project — Sra-admin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39301",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-39301",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-22T15:43:29.777489Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "momofoolish",
          "product": "sra-admin",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-19T14:15:09.747",
  "references": [
    {
      "url": "https://github.com/momofoolish/sra-admin/security/advisories/GHSA-v7r9-qx74-h3v8",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/momofoolish/sra-admin/security/advisories/GHSA-v7r9-qx74-h3v8",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in \"Personal Center\" - \"Profile Picture Upload\" allowing theft of the user's personal information. This issue has been patched in 1.1.2. There are no known workarounds."
    },
    {
      "lang": "es",
      "value": "sra-admin es un sistema de administración de derechos en segundo plano que separa el front y el back end. La versión 1.1.1 de sra-admin presenta una vulnerabilidad de tipo cross-site scripting (XSS) de almacenamiento. Después de iniciar sesión en el fondo de sra-admin, un atacante puede descargar una página html que contenga código de ataque de tipo xss en \"Personal Center\" - \"Profile Picture Upload\", lo que permite el robo de la información personal del usuario. Este problema ha sido parcheado en la versión 1.1.2. No se presentan mitigaciones conocidas"
    }
  ],
  "lastModified": "2026-06-17T04:58:06.103",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sra-admin_project:sra-admin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "452BE26C-6CB7-41D9-BFD4-A95C7ABDDD21",
              "versionEndIncluding": "1.1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}