CVE-2022-3941
Published: 11 November 2022
Summary
CVE-2022-3941 is a medium-severity Improper Neutralization (CWE-707) vulnerability in Activity Log Project Activity Log. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 46.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43275
Vulnerability details
A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can…
more
be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development.
Validating that output matches expected content directly mitigates failures to properly encode or escape data for its destination context.