« Volver al listado

CVE-2022-38972

Estado: ModificadaMedia (6.1)—

Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ark-web — A-form

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-38972",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "ARK-Web co., ltd.",
          "product": "A-Form",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-12T02:15:07.807",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN48120704/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ark-web.jp/blog/archives/2022/09/a-series-411-391.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.ark-web.jp/movabletype/blog/2022/09/a-series-411-391.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN48120704/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ark-web.jp/blog/archives/2022/09/a-series-411-391.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ark-web.jp/movabletype/blog/2022/09/a-series-411-391.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting en Movable Type plugin A-Form versiones anteriores a 4.1.1 (para la serie 7 de Movable Type) y versiones anteriores a 3.9.1 (para la serie 6 de Movable Type) permite a un atacante remoto no autenticado inyectar un script arbitrario"
    }
  ],
  "lastModified": "2026-06-17T04:57:21.250",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ark-web:a-form:*:*:*:*:*:movable_type_6_series:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8885513E-72FC-4DB5-A274-B41B4A484165",
              "versionEndExcluding": "3.9.1"
            },
            {
              "criteria": "cpe:2.3:a:ark-web:a-form:*:*:*:*:*:movable_type_7_series:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55A0147D-787A-48AB-B444-68BA5CC1FBFC",
              "versionEndExcluding": "4.1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}