CVE-2022-33098

MediumCVSS 6.1

Published: 07/07/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

51.62%

99th percentile - higher than 99% of all known CVEs

Summary

Magnolia CMS v6.2.19 contains a cross-site scripting (XSS) vulnerability in the Edit Contact function. An attacker can inject arbitrary JavaScript or HTML by uploading a crafted SVG document as a profile picture.

Risk Assessment

The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately upgrade Magnolia CMS to a version newer than 6.2.19 and implement validation and sanitization of uploaded SVG files.

Original NVD description (English source)

Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.