CVE-2022-24864

{"containers": {"cna": {"affected": [{"product": "origin-website", "vendor": "OriginProtocol", "versions": [{"status": "affected", "version": "< c12d2f2"}]}], "descriptions": [{"lang": "en", "value": "Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient\u2019s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-20T18:25:12.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/OriginProtocol/origin-website/pull/617"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/github/codeql/pull/7127"}], "source": {"advisory": "GHSA-v6fc-qwxx-m4h7", "discovery": "UNKNOWN"}, "title": "Malicious Javascript injection in OriginProtocol/origin-website", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24864", "STATE": "PUBLIC", "TITLE": "Malicious Javascript injection in OriginProtocol/origin-website"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "origin-website", "version": {"version_data": [{"version_value": "< c12d2f2"}]}}]}, "vendor_name": "OriginProtocol"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient\u2019s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7", "refsource": "CONFIRM", "url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7"}, {"name": "https://github.com/OriginProtocol/origin-website/pull/617", "refsource": "MISC", "url": "https://github.com/OriginProtocol/origin-website/pull/617"}, {"name": "https://github.com/github/codeql/pull/7127", "refsource": "MISC", "url": "https://github.com/github/codeql/pull/7127"}]}, "source": {"advisory": "GHSA-v6fc-qwxx-m4h7", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.594Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/OriginProtocol/origin-website/pull/617"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/github/codeql/pull/7127"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:08:07.258041Z", "id": "CVE-2022-24864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T18:33:38.078Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24864", "datePublished": "2022-04-20T18:25:12.000Z", "dateReserved": "2022-02-10T00:00:00.000Z", "dateUpdated": "2025-04-23T18:33:38.078Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/OriginProtocol/origin-website/pull/617", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/github/codeql/pull/7127", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.594Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-24864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:08:07.258041Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:08:08.579Z"}}], "cna": {"title": "Malicious Javascript injection in OriginProtocol/origin-website", "source": {"advisory": "GHSA-v6fc-qwxx-m4h7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "OriginProtocol", "product": "origin-website", "versions": [{"status": "affected", "version": "< c12d2f2"}]}], "references": [{"url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OriginProtocol/origin-website/pull/617", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/github/codeql/pull/7127", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient\u2019s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-04-20T18:25:12.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, "source": {"advisory": "GHSA-v6fc-qwxx-m4h7", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< c12d2f2"}]}, "product_name": "origin-website"}]}, "vendor_name": "OriginProtocol"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7", "name": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7", "refsource": "CONFIRM"}, {"url": "https://github.com/OriginProtocol/origin-website/pull/617", "name": "https://github.com/OriginProtocol/origin-website/pull/617", "refsource": "MISC"}, {"url": "https://github.com/github/codeql/pull/7127", "name": "https://github.com/github/codeql/pull/7127", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient\u2019s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-24864", "STATE": "PUBLIC", "TITLE": "Malicious Javascript injection in OriginProtocol/origin-website", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-24864", "state": "PUBLISHED", "dateUpdated": "2025-04-23T18:33:38.078Z", "dateReserved": "2022-02-10T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-04-20T18:25:12.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "origin-website", "vendor": "OriginProtocol", "versions": [{"status": "affected", "version": "< c12d2f2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:originprotocol:origin_website:*:*:*:*:*:*:*:*", "matchCriteriaId": "7371A858-EE6A-4541-9C46-8578F52174D3", "versionEndExcluding": "2022-01-10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient\u2019s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds."}, {"lang": "es", "value": "Origin Protocol es un proyecto basado en blockchain. El sitio web del proyecto Origin Protocol permite a usuarios maliciosos inyectar Javascript malicioso por medio de una petici\u00f3n POST a \"/presale/join\". Los datos controlados por el usuario son pasados sin sanear a SendGrid y son inyectados en un correo electr\u00f3nico que es entregado a founders@originprotocol.com. Si el destinatario del correo electr\u00f3nico usa un programa de correo electr\u00f3nico que es susceptible de una vulnerabilidad de tipo XSS, entonces ese destinatario recibir\u00e1 un correo electr\u00f3nico que puede contener una vulnerabilidad de tipo XSS malicioso. Independientemente de si el programa de correo electr\u00f3nico del destinatario presenta vulnerabilidades o no, el hacker puede, como m\u00ednimo, inyectar HTML malicioso que modifique el contenido del cuerpo del correo electr\u00f3nico. Actualmente no son conocidas medidas de mitigaci\u00f3n"}], "id": "CVE-2022-24864", "lastModified": "2026-06-17T04:32:41.247", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-24864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T14:08:07.258041Z", "version": "2.0.3"}}]}, "published": "2022-04-20T19:15:08.037", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OriginProtocol/origin-website/pull/617"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/github/codeql/pull/7127"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OriginProtocol/origin-website/pull/617"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/github/codeql/pull/7127"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}