CVE-2022-24710: Cross-site Scripting in Weblate
First published: Fri Feb 25 2022(Updated: )
### Impact Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names. ### Patches The issues were fixed in the 4.11 release. The following commits are addressing it: * f6753a1a1c63fade6ad418fbda827c6750ab0bda * 9e19a8414337692cc90da2a91c9af5420f2952f1 * 22d577b1f1e88665a88b4569380148030e0f8389 ### Workarounds You can look for crafted user and language names to see if you were affected. ### References * https://hackerone.com/reports/1486674 * https://hackerone.com/reports/1486718 * https://hackerone.com/reports/1485226 ### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/Weblate | <4.11 | 4.11 |
| Weblate | <4.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389
- https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1
- https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bda
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66
- https://nvd.nist.gov/vuln/detail/CVE-2022-24710
- https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-35.yaml
- https://github.com/advisories/GHSA-6jp6-9rf9-gc66 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2022-24710?
CVE-2022-24710 has medium severity due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2022-24710?
To fix CVE-2022-24710, upgrade to Weblate version 4.11 or later.
What software is affected by CVE-2022-24710?
CVE-2022-24710 affects Weblate versions prior to 4.11.
What type of vulnerability is CVE-2022-24710?
CVE-2022-24710 is a cross-site scripting vulnerability due to improper neutralization.
Where can I find patches for CVE-2022-24710?
Patches for CVE-2022-24710 are included in the Weblate 4.11 release.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/severity
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6jp6-9rf9-gc66
- alias/CVE-2022-24710
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- agent/author
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/pip
- vendor/weblate
- canonical/weblate