{"id":"CVE-2022-1928","published":"2022-05-29T00:00:00Z","modified":"2024-08-03T00:17:00Z","title":"Cross-site Scripting (XSS) - Stored in go-gitea/gitea","vendor":"go-gitea","product":"go-gitea/gitea","tier":"tail","description":{"text":"Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00803,"percentile":0.56564,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://huntr.dev/bounties/6336ec42-5c4d-4f61-ae38-2bb539f433d2","tags":[]},{"url":"https://github.com/go-gitea/gitea/commit/65e0688a5c9dacad50e71024b7529fdf0e3c2e9c","tags":[]},{"url":"https://security.gentoo.org/glsa/202210-14","tags":["vendor-advisory"]}],"priority":{"score":14.4,"factors":[{"name":"EPSS percentile","points":11.31},{"name":"CVSS severity","points":3.08}]},"vendorSlug":"go-gitea","affectedVersions":[{"vendor":"go-gitea","product":"go-gitea/gitea","versions":[">= unspecified, < 1.16.9"]}],"affected":[{"ecosystem":"Go","package":"code.gitea.io/gitea","vulnerableRanges":["<1.16.9"],"patched":["1.16.9"],"from":["GHSA-ph3w-2843-72mx","GO-2022-0612"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4768","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-27313","published":"2022-05-03","fixed":"1.16.4","kev":false},{"cve":"CVE-2022-1058","published":"2022-03-24","fixed":"1.16.5","kev":false},{"cve":"CVE-2022-30781","published":"2022-05-16","fixed":"1.16.7","kev":false,"link":{"from":"CVE-2022-30781","to":"CVE-2022-1928","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.7","toFixed":"1.16.9","daysApart":13}]}},{"cve":"CVE-2022-1928","published":"2022-05-29","fixed":"1.16.9","kev":false},{"cve":"CVE-2022-38183","published":"2022-08-12","fixed":"1.16.9","kev":false},{"cve":"CVE-2022-38795","published":"2023-08-07","fixed":"1.17.2","kev":false},{"cve":"CVE-2022-42968","published":"2022-10-16","fixed":"1.17.3","kev":false}],"package":"Go:code.gitea.io/gitea"}}