{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-3958", "assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee", "assignerShortName": "HW", "datePublished": "2022-11-15T14:24:49.568Z", "dateUpdated": "2025-04-29T20:09:39.611Z", "dateReserved": "2022-11-11T00:00:00.000Z"}, "containers": {"cna": {"title": "Potential XSS on personal menu navigation", "datePublic": "2022-11-15T00:00:00.000Z", "providerMetadata": {"orgId": "ff95705b-1a40-4639-8017-a58fa868baee", "shortName": "HW", "dateUpdated": "2022-11-15T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks."}], "affected": [{"vendor": "Hallo Welt! GmbH", "product": "BlueSpice", "versions": [{"version": "4", "status": "affected", "lessThan": "4.2.1", "versionType": "custom"}]}], "references": [{"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-79 Cross-site Scripting (XSS)", "cweId": "CWE-79"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "BSSA-2022-07", "discovery": "INTERNAL"}, "solutions": [{"lang": "en", "value": "Upgrade to BlueSpice 4.2.1 or later"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:27:53.105Z"}, "title": "CVE Program Container", "references": [{"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-29T20:09:32.401312Z", "id": "CVE-2022-3958", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T20:09:39.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:27:53.105Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-3958", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-29T20:09:32.401312Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T20:09:35.769Z"}}], "cna": {"title": "Potential XSS on personal menu navigation", "source": {"advisory": "BSSA-2022-07", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Hallo Welt! GmbH", "product": "BlueSpice", "versions": [{"status": "affected", "version": "4", "lessThan": "4.2.1", "versionType": "custom"}]}], "solutions": [{"lang": "en", "value": "Upgrade to BlueSpice 4.2.1 or later"}], "datePublic": "2022-11-15T00:00:00.000Z", "references": [{"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)"}]}], "providerMetadata": {"orgId": "ff95705b-1a40-4639-8017-a58fa868baee", "shortName": "HW", "dateUpdated": "2022-11-15T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3958", "state": "PUBLISHED", "dateUpdated": "2025-04-29T20:09:39.611Z", "dateReserved": "2022-11-11T00:00:00.000Z", "assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee", "datePublished": "2022-11-15T14:24:49.568Z", "assignerShortName": "HW"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hallowelt:bluespice:*:*:*:*:*:*:*:*", "matchCriteriaId": "696F93D5-AB35-4EA3-AEDB-9C868E94ED6D", "versionEndExcluding": "4.2.1", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en la extensi\u00f3n BlueSpiceUserSidebar de BlueSpice permite a los usuarios con cuenta normal y permisos de edici\u00f3n inyectar HTML arbitrario en el men\u00fa de navegaci\u00f3n personal de sus propios usuarios y de otros usuarios. Esto permite ataques dirigidos."}], "id": "CVE-2022-3958", "lastModified": "2024-11-21T07:20:36.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security@bluespice.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-15T15:15:13.057", "references": [{"source": "security@bluespice.com", "tags": ["Vendor Advisory"], "url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"}], "sourceIdentifier": "security@bluespice.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@bluespice.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}