CVE-2022-50966
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The uBidAuction 2.0.1 plugin contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Risk Assessment
The risk involves potential session theft, credential capture, or unauthorized actions performed in the context of the victim's account, which could lead to confidentiality and integrity breaches within the organization.
Recommendation
Immediately update the uBidAuction plugin to the latest patched version and implement input validation and output encoding for all filter parameters.
Other vulnerabilities in uBidAuction
See all- CVE-2022-50969Medium
Reflected XSS in the backend/mailingLog/manage module of uBidAuction 2.0.1 via unsanitized date_created, date_from, date_to, and created_at parameters, allowing remote attackers to inject malicious scripts via crafted GET requests.
- CVE-2022-50968Medium
A reflected XSS vulnerability exists in the auctions/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- CVE-2022-50967Medium
A reflected XSS vulnerability exists in the tickets/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- CVE-2022-50965Medium
A reflected XSS vulnerability exists in the posts/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- CVE-2022-50964Medium
A reflected XSS vulnerability exists in the auctions/myAuctions/status/loose module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- CVE-2022-50963Medium
A reflected XSS vulnerability exists in the auctions/myAuctions/status/active module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
- CVE-2022-50962Medium
A reflected XSS vulnerability exists in the orders/myOrders module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Original NVD description (English source)
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS