// For flags

CVE-2022-46151

Reflected XSS

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.

Querybook es una interfaz de usuario de consulta de datos de código abierto. En las versiones afectadas, los datos proporcionados por el usuario no se escapan en el campo de error de la URL de devolución de llamada de autenticación en `querybook/server/app/auth/oauth_auth.py` y `querybook/server/app/auth/okta_auth.py`. Esto puede permitir a los atacantes realizar Cross-Site Scripting (XSS) Reflejado si la Política de seguridad de contenido (CSP) no está habilitada o si se permite "inseguro en línea". Se recomienda a los usuarios que actualicen a la última versión parcheada de querybook (versión 3.14.2 o superior). Los usuarios que no puedan actualizar pueden habilitar CSP y no permitir parámetros de consulta en línea inseguros o de escape manual en un proxy inverso.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-28 CVE Reserved
  • 2022-12-06 CVE Published
  • 2024-06-28 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pinterest
Search vendor "Pinterest"
 Querybook
Search vendor "Pinterest" for product "Querybook"
 < 3.14.2
Search vendor "Pinterest" for product "Querybook" and version " < 3.14.2"
-
Affected