6.1 - CVE-2022-46151

Executive Summary

Informations
Name	CVE-2022-46151	First vendor Publication	2022-12-06
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Overall CVSS Score	6.1
Base Score	6.1	Environmental Score	6.1
impact SubScore	2.7	Temporal Score	6.1
Exploitabality Sub Score	2.8

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	Required
Scope	Changed	Confidentiality Impact	Low
Integrity Impact	Low	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46151

CPE : Common Platform Enumeration

Type	Description	Count
Application	Pinterest Querybook cpe:2.3:a:pinterest:querybook::::::::	1

Sources (Detail)

https://github.com/pinterest/querybook/commit/88a7f10495bf5ed1a556ade51a2f279...
https://github.com/pinterest/querybook/security/advisories/GHSA-mrrw-9wf7-xq6w

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 14:17:34	Multiple Updates
2022-12-07 21:27:11	Multiple Updates
2022-12-07 02:10:04	Multiple Updates
2022-12-07 02:10:03	Multiple Updates
2022-12-06 17:27:12	Multiple Updates
2022-12-06 09:27:13	First insertion