CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab
Attackers can inject malicious scripts into Autolab, potentially stealing user sessions or executing code in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0936?
CVE-2022-0936 is a high-severity cross-site scripting vulnerability in autolab/autolab, published on 11 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
Weakness: CWE-79
Which versions are affected by CVE-2022-0936?
It affects 1 product.
Products include Autolabproject Autolab.
How do I fix CVE-2022-0936?
No fix has been published for CVE-2022-0936 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-0936 being exploited?
There is no known exploitation of CVE-2022-0936 in the wild and no public exploit code.
Other vulnerabilities in autolab/autolab
- CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality
- CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab
- CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions
- CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab
- CVE-2023-32317 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)
Sources
Also known as GHSA-6hcq-48q8-26c8.