CVE-2022-2173 Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

What is CVE-2022-2173?

CVE-2022-2173 is a medium-severity cross-site scripting vulnerability in Unknown Advanced Database Cleaner, published on 17 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

Weakness: CWE-79

Which versions are affected by CVE-2022-2173?

It affects 1 product.

Products include Sigmaplugin Advanced Database Cleaner.

How do I fix CVE-2022-2173?

No fix has been published for CVE-2022-2173 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-2173 being exploited?

There is no known exploitation of CVE-2022-2173 in the wild and no public exploit code.

Other vulnerabilities in Unknown Advanced Database Cleaner

• CVE-2023-49764 WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection High 7.6
• CVE-2021-24141 Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection High 7.2
• CVE-2024-0668 Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action Medium 6.6
• CVE-2021-24921 Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2022-46813 WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h52v-6ppv-4xw2.