CVE-2022-4902

MEDIO 6.1CVE-2022-4902 · Published 06/02/2023 · updated 17/06/2026

In breve

CVE-2022-4902 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda chat application (exoplatform).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.59%, superiore al 48.6% delle vulnerabilità.
Correzione: aggiornare a 3.3.0-202204117 o successiva.

Package	Affected versions	Patched versions
chat application exoplatform	`< 3.3.0-202204117`	`3.3.0-202204117`

Description

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212.

References

community.exoplatform.com/portal/dw/tasks/taskDetail/56304 · Permissions Required
exoplatform/chat-application commit 26bf307 · Patch
exoplatform/chat-application#485 · Patch
exoplatform/chat-application release 3.3.0-20220417 · Third Party Advisory
vuldb.com · Permissions Required
vuldb.com · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free