CVE-2022-2168
Published: 17 July 2022
Summary
CVE-2022-2168 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in W3Eden Download Manager. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a reflected cross-site scripting flaw (CWE-79) in the Download Manager WordPress plugin before version 3.2.44. The plugin does not escape a generated URL before including it in an attribute on the history dashboard, allowing script content to be reflected back to the browser.
An unauthenticated remote attacker can supply a crafted URL that, when visited by a user such as an administrator viewing the dashboard, executes arbitrary JavaScript in the site’s origin. The CVSS vector indicates the attack requires user interaction but no privileges, with limited confidentiality and integrity impact scoped to the affected page.
The WPScan advisory linked in the references identifies the affected versions and states that the issue is resolved by updating to Download Manager 3.2.44 or later, which adds proper escaping of the generated URL.
The associated EPSS score remains in a narrow band between its recorded peak of 0.1410 and current value of 0.1320.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34453
Vulnerability details
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.