CVE-2022-22126

Openmct XSS via the “Web Page” element

State: Published
Severity: 6.1 Medium
Published: Feb 20, 2022
Updated: Aug 3, 2024
Reserved: Dec 21, 2021

Description

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Mend

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
openmctnasa	1.7.7 through 1.7.7Affected 1.3.0 to before 1.3.0*Affected

References

https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.