CVE-2022-33098

EPSS 51.6%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS —EPSS 51.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

07 Jul 2022Published on NVD

21 Jul 2022Public PoC

Weaponization speed

13 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.

Affected products

n/a · n/a

public PoCs found — 2

githubgithub.com/Ozozuz/Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098★ 2 exploitdbwww.exploit-db.com/exploits/50976unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/167705/Magnolia-CMS-6.2.19-Cross-Site-Scripting.html https://docs.magnolia-cms.com/product-docs/6.2/releases/release-notes-for-magnolia-cms-6.2.22/