CVE-2022-0776
Published: 01 March 2022
Summary
CVE-2022-0776 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Revealjs Reveal.Js. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-0776 is a DOM-based cross-site scripting vulnerability (CWE-79) affecting the reveal.js presentation framework in the hakimel/reveal.js GitHub repository prior to version 4.3.0. The flaw carries a CVSS 3.1 base score of 6.1 with network attack vector, low complexity, no privileges required, and required user interaction, resulting in changed scope with limited impacts to confidentiality and integrity.
An unauthenticated remote attacker can exploit the issue by supplying a crafted payload that is processed client-side within a reveal.js slide deck; successful exploitation allows execution of arbitrary script in the context of a victim’s browser, enabling actions such as theft of session data or manipulation of page content visible to the user.
Public references point to a fix merged in commit 32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2, which updates the library to 4.3.0; the associated huntr.dev report documents the same remediation. The EPSS score reached a peak of 0.2005 after disclosure before settling at the current value of 0.1032, indicating a measurable increase in observed exploitation interest following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1442
Vulnerability details
Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.