{"containers": {"cna": {"affected": [{"product": "Black Duck Hub", "vendor": "Synopsys", "versions": [{"status": "affected", "version": "< 2022.4.0"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Black Duck Hub\u2019s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-10T19:47:30", "orgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "shortName": "SNPS"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "disclosure@synopsys.com", "ID": "CVE-2022-30278", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Black Duck Hub", "version": {"version_data": [{"version_value": "< 2022.4.0"}]}}]}, "vendor_name": "Synopsys"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in Black Duck Hub\u2019s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/", "refsource": "MISC", "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/"}]}}}}, "cveMetadata": {"assignerOrgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "assignerShortName": "SNPS", "cveId": "CVE-2022-30278", "datePublished": "2022-05-10T19:47:30", "dateReserved": "2022-05-04T00:00:00", "dateUpdated": "2022-05-10T19:47:30", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:synopsys:black_duck_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "34F9EDE0-676C-4404-A79D-77FB2A89C6B9", "versionEndExcluding": "2022.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Black Duck Hub\u2019s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information."}, {"lang": "es", "value": "Una vulnerabilidad en los archivos de documentaci\u00f3n de MadCap Flare insertados en Black Duck Hub podr\u00eda permitir a un atacante remoto no autenticado realizar un ataque de tipo cross-site scripting. La vulnerabilidad es debido a que no ha sido comprobada apropiadamente la entrada suministrada por el usuario al marco de MadCap Flare insertado en la documentaci\u00f3n de ayuda de Black Duck Hub para suministrar contenido. Un atacante podr\u00eda explotar esta vulnerabilidad al convencer a un usuario para que haga clic en un enlace dise\u00f1ado para pasar una entrada maliciosa a la interfaz. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conducir ataques de tipo cross-site scripting y conseguir acceso a informaci\u00f3n confidencial basada en el navegador"}], "id": "CVE-2022-30278", "lastModified": "2022-05-18T16:38:17.787", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-10T20:15:09.827", "references": [{"source": "disclosure@synopsys.com", "tags": ["Vendor Advisory"], "url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/"}], "sourceIdentifier": "disclosure@synopsys.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@synopsys.com", "type": "Secondary"}]}

{}