CVE-2022-22125: Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22125?
The severity of CVE-2022-22125 is considered high due to the potential impact of stored XSS on affected systems.
How do I fix CVE-2022-22125?
To fix CVE-2022-22125, upgrade Halo to a version later than v1.4.17, where the vulnerability has been patched.
Who is affected by CVE-2022-22125?
Authenticated admin users of Halo versions v1.0.0 to v1.4.17 are primarily affected by CVE-2022-22125.
What type of vulnerability is CVE-2022-22125?
CVE-2022-22125 is a Stored Cross-Site Scripting (XSS) vulnerability.
What can an attacker do with CVE-2022-22125?
An attacker can inject arbitrary JavaScript code that executes on a victim's server, potentially leading to unauthorized actions or data exposure.