BIT-appsmith-2022-39824

vendorUSosv

view advisory published 2024-03-06Licence: per source

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or achieve an information leak.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-39824US	high8.9	1.10% (65th)	—	2022-09-05
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list wi…

references

External citations — patches, advisories, analysis.

https://github.com/FCncdn/Appsmith-Js-Injection-POCADVISORY
https://github.com/appsmithorg/appsmith/releasesADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-39824WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan