Cyber Resilience

CVE-2022-40047

MediumPublic PoC

Published: 11 October 2022

Published
11 October 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.2449 96.2th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-40047 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Flatpress Flatpress. Its CVSS base score is 5.4 (Medium).

Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Flatpress version 1.2.1 contains a reflected cross-site scripting vulnerability (CWE-79) that is triggered when the page parameter is supplied to the /flatpress/admin.php endpoint. The flaw received a CVSS 3.1 score of 5.4, reflecting network attack vector, low attack complexity, low privileges required, and required user interaction, with limited confidentiality and integrity impact under changed scope.

An authenticated user with low privileges can be induced to follow a crafted link that reflects attacker-controlled script into the administrative interface, allowing execution of arbitrary JavaScript in the context of another user’s session. Successful exploitation can therefore result in session hijacking, unauthorized actions within the Flatpress installation, or theft of sensitive administrative data.

The associated GitHub issue and project site do not describe an official patch or mitigation steps. The EPSS score has remained at 0.2449 with no material increase since disclosure.

EU & UK References

Vulnerability details

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

flatpress
flatpress
1.2.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References