Vulnerability · Published May 10, 2022 · Assigned by SNPS
CVE-2022-30278
Medium 6.1
In plain English
A medium-severity cross-site scripting in Black Duck Hub from Synopsys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synopsys | Black Duck Hub | < 2022.4.0 |
Weakness: CWE-79