CVE-2022-4527 json
collective.task table.py AssignedGroupColumn cross site scripting
published 2022-12-15 3 y ago modified 2026-06-17 4 mo ago also GHSA-4r9h-x77w-mffv , PYSEC-2022-42990 , EUVD-2022-0045
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba02748912953461f3fac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215907.
Patch / fix
- pypi collective-task 3.0.9, 3.0.10
- collective.task_project collective.task 3.0.9
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | collective-task | <3.0.9 <3.0.10 |
3.0.9 3.0.10 |
Affected products
- n/a collective.task
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/collective/collective.task/commit/1aac7f83fa2c2b41d59ba02748912953461f3fac
mitigation, patch, web, third-party-advisory
-
vuldb.com
/?id.215907
technical-description, vdb-entry, web, third-party-advisory
-
github.com
/collective/collective.task/releases/tag/3.0.9
mitigation, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-4527
advisory
-
github.com
/collective/collective.task
package
-
github.com
/collective/collective.task/releases/tag/3.0.10
web
-
github.com
/pypa/advisory-database/tree/main/vulns/collective-task/PYSEC-2022-42990.yaml
web
-
github.com
/advisories/GHSA-4r9h-x77w-mffv
advisory
Sources
- CVE List CVE-2022-4527
- GitHub Advisory GHSA-4r9h-x77w-mffv
- NVD CVE-2022-4527
- OSV PYSEC-2022-42990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.