CVE-2022-3958

Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@bluespice.com

Published

2022-11-15

Last modified

2025-04-29

Weaknesses

CWE-79

Affected products

• Bluespice (Hallo Welt Gmbh)
• Bluespice (Hallowelt)

References

• https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07