CVE-2022-43996 json
csaf-poc/csaf_distribution Cross-site Scripting vulnerability
published 2022-12-13 3 y ago modified 2026-06-17 4 mo ago also GHSA-xxfx-w2rw-gh63 , GO-2022-1164 , EUVD-2022-7779
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory.
Patch / fix
- go github.com/csaf-poc/csaf_distribution 0.8.2
- csaf_provider_project csaf_provider 0.8.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/csaf-poc/csaf_distribution | <0.8.2 |
0.8.2 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/csaf-poc/csaf_distribution/commit/17f22855ee8d4270dd17ff748c30ed7304846fdc
web, patch
-
wid.cert-bund.de
/.well-known/csaf/white/2022/bsi-2022-0003.json
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-43996
advisory
-
github.com
/csaf-poc/csaf_distribution
package
-
github.com
/csaf-poc/csaf_distribution/releases/tag/v0.8.2
web
-
github.com
/advisories/GHSA-xxfx-w2rw-gh63
advisory
Sources
- CVE List CVE-2022-43996
- GitHub Advisory GHSA-xxfx-w2rw-gh63
- NVD CVE-2022-43996
- OSV GO-2022-1164
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.