{"id":"CVE-2022-37246","published":"2022-09-21T14:14:01Z","modified":"2025-05-27T18:23:15Z","title":"Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file…","vendor":null,"product":null,"tier":"tail","description":{"text":"Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0052,"percentile":0.44211,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b","tags":["x_refsource_MISC"]},{"url":"https://labs.integrity.pt/advisories/cve-2022-37246/","tags":["x_refsource_MISC"]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":8.84},{"name":"CVSS severity","points":3.78}]},"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.0.0-RC1, <4.2.1",">=3.7.39, <3.7.51"],"patched":["4.2.1","3.7.51"],"from":["GHSA-f546-v666-559x"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6790","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-37783","published":"2022-12-05","fixed":"3.7.33","kev":false},{"cve":"CVE-2022-29933","published":"2022-05-09","fixed":"3.7.36","kev":false},{"cve":"CVE-2023-30177","published":"2023-04-25","fixed":"3.7.68","kev":false},{"cve":"CVE-2022-37246","published":"2022-09-21","fixed":"4.2.1","kev":false},{"cve":"CVE-2022-37247","published":"2022-09-16","fixed":"4.2.1","kev":false},{"cve":"CVE-2022-37248","published":"2022-09-16","fixed":"4.2.1","kev":false},{"cve":"CVE-2022-37250","published":"2022-09-16","fixed":"4.2.1","kev":false},{"cve":"CVE-2022-37251","published":"2022-09-16","fixed":"4.2.1","kev":false,"link":{"from":"CVE-2022-37246","to":"CVE-2022-37251","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"3.7.51","toFixed":"3.7.55.2","daysApart":-5}]}}],"package":"Packagist:craftcms/cms"}}