CVE-2022-43996 json
csaf-poc/csaf_distribution Cross-site Scripting vulnerability
published 3y ago modified 4mo ago also GHSA-xxfx-w2rw-gh63 , GO-2022-1164 , EUVD-2022-7779
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory.
Patch / fix
- go github.com/csaf-poc/csaf_distribution 0.8.2
- csaf_provider_project csaf_provider 0.8.2
Is CVE-2022-43996 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/csaf-poc/csaf_distribution | <0.8.2 |
0.8.2 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/csaf-poc/csaf_distribution/commit/17f22855ee8d4270dd17ff748c30ed7304846fdc
web, patch
-
wid.cert-bund.de
/.well-known/csaf/white/2022/bsi-2022-0003.json
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-43996
advisory
-
github.com
/csaf-poc/csaf_distribution
package
-
github.com
/csaf-poc/csaf_distribution/releases/tag/v0.8.2
web
-
github.com
/advisories/GHSA-xxfx-w2rw-gh63
advisory
Sources
- CVE List CVE-2022-43996
- GitHub Advisory GHSA-xxfx-w2rw-gh63
- NVD CVE-2022-43996
- OSV GO-2022-1164
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.