CVE-2022-36037

{"containers": {"cna": {"affected": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 3.5.8.1"}]}], "descriptions": [{"lang": "en", "value": "kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-29T17:35:09.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1"}], "source": {"advisory": "GHSA-3f89-869f-5w76", "discovery": "UNKNOWN"}, "title": "Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-36037", "STATE": "PUBLIC", "TITLE": "Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "kirby", "version": {"version_data": [{"version_value": "< 3.5.8.1"}]}}]}, "vendor_name": "getkirby"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76", "refsource": "CONFIRM", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76"}, {"name": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5", "refsource": "MISC", "url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5"}, {"name": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1", "refsource": "MISC", "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1"}]}, "source": {"advisory": "GHSA-3f89-869f-5w76", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:51:59.947Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:01:53.697578Z", "id": "CVE-2022-36037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T17:47:26.361Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-36037", "datePublished": "2022-08-29T17:35:09.000Z", "dateReserved": "2022-07-15T00:00:00.000Z", "dateUpdated": "2025-04-23T17:47:26.361Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:51:59.947Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-36037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T14:01:53.697578Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:01:54.940Z"}}], "cna": {"title": "Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby", "source": {"advisory": "GHSA-3f89-869f-5w76", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 3.5.8.1"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-08-29T17:35:09.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "GHSA-3f89-869f-5w76", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< 3.5.8.1"}]}, "product_name": "kirby"}]}, "vendor_name": "getkirby"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76", "refsource": "CONFIRM"}, {"url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5", "name": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5", "refsource": "MISC"}, {"url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1", "name": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-36037", "STATE": "PUBLIC", "TITLE": "Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-36037", "state": "PUBLISHED", "dateUpdated": "2025-04-23T17:47:26.361Z", "dateReserved": "2022-07-15T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-08-29T17:35:09.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 3.5.8.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7E15C20-5139-414E-AB93-B9130DE9DB16", "versionEndExcluding": "3.5.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. If bad actors gain access to your group of authenticated Panel users they can escalate their privileges via the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. The multiselect field allows selection of tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed **attackers with influence on the options source** to store HTML code. The browser of the victim who visited a page with manipulated multiselect options in the Panel will then have rendered this malicious HTML code when the victim opened the autocomplete dropdown. Users are *not* affected by this vulnerability if you don't use the multiselect field or don't use it with options that can be manipulated by attackers. The problem has been patched in Kirby 3.5.8.1."}, {"lang": "es", "value": "kirby es un sistema de administraci\u00f3n de contenidos (CMS) que es adaptada a muchos proyectos diferentes y le ayuda a construir su propia interfaz ideal. Una vulnerabilidad de tipo cross-site scripting (XSS) es un tipo de vulnerabilidad que permite una ejecuci\u00f3n de cualquier tipo de c\u00f3digo JavaScript dentro de la sesi\u00f3n del Panel del mismo u otros usuarios. En el Panel, un script da\u00f1ino puede, por ejemplo, lanzar peticiones a la API de Kirby con los permisos de la v\u00edctima. Si los actores maliciosos consiguen acceder a su grupo de usuarios autenticados del Panel, pueden escalar sus privilegios por medio de la sesi\u00f3n del Panel de un usuario administrador. Dependiendo de su sitio, es posible realizar otros ataques con JavaScript. El campo multiselecci\u00f3n permite seleccionar etiquetas de una lista autocompletada. Desafortunadamente, el Panel en Kirby versi\u00f3n 3.5 usaba el renderizado HTML para el valor crudo de la opci\u00f3n. Esto permit\u00eda a **atacantes con influencia en el origen de las opciones** almacenar c\u00f3digo HTML. El navegador de la v\u00edctima que visit\u00f3 una p\u00e1gina con opciones multiselecci\u00f3n manipuladas en el Panel habr\u00e1 renderizado este c\u00f3digo HTML malicioso cuando la v\u00edctima abri\u00f3 el desplegable de autocompletar. Los usuarios *no* est\u00e1n afectados por esta vulnerabilidad si no usan el campo multiselect o no lo usan con opciones que puedan ser manipuladas por los atacantes. El problema ha sido parcheado en Kirby versi\u00f3n 3.5.8.1"}], "id": "CVE-2022-36037", "lastModified": "2026-06-17T04:52:47.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-36037", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T14:01:53.697578Z", "version": "2.0.3"}}]}, "published": "2022-08-29T18:15:09.870", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/commit/b5b8863885e17556abc070dde1e20aec15fbfdf5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-3f89-869f-5w76"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}