CVE-2022-40047
Published: 11 October 2022
Summary
CVE-2022-40047 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Flatpress Flatpress. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Flatpress version 1.2.1 contains a reflected cross-site scripting vulnerability (CWE-79) that is triggered when the page parameter is supplied to the /flatpress/admin.php endpoint. The flaw received a CVSS 3.1 score of 5.4, reflecting network attack vector, low attack complexity, low privileges required, and required user interaction, with limited confidentiality and integrity impact under changed scope.
An authenticated user with low privileges can be induced to follow a crafted link that reflects attacker-controlled script into the administrative interface, allowing execution of arbitrary JavaScript in the context of another user’s session. Successful exploitation can therefore result in session hijacking, unauthorized actions within the Flatpress installation, or theft of sensitive administrative data.
The associated GitHub issue and project site do not describe an official patch or mitigation steps. The EPSS score has remained at 0.2449 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43369
Vulnerability details
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.