Is CVE-2022-39350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39350 being exploited in the wild.

How severe is CVE-2022-39350?

Low severity, with a CVSS score of 3.1, published 25 October 2022.

Which products and versions are affected?

@dependencytrack/frontend (npm) SEMVER:introduced=0,fixed=4.6.1.

Is there a fix for CVE-2022-39350?

Yes. @dependencytrack/frontend (npm): upgrade to 4.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39350 attacked?

It is attacked over the network.

Am I affected by CVE-2022-39350?

Check whether you run @dependencytrack/frontend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39350: Dependency-Track Frontend persistent cross-site scripting in vulnerability details

CVE-2022-39350 · Severity: low · CVSS 3.1 · Published 2022-10-25

Dependency-Track Frontend is a web interface for managing software vulnerabilities and dependencies. The application failed to sanitize vulnerability descriptions rendered from markdown, allowing authenticated users with vulnerability management permissions to inject malicious JavaScript code. When other users view the affected vulnerability page, the injected code executes in their browser, potentially leading to session hijacking, data theft, or credential compromise.

Vendors: npm.

Quick answers

Is CVE-2022-39350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39350 being exploited in the wild.
How severe is CVE-2022-39350?: Low severity, with a CVSS score of 3.1, published 25 October 2022.
Which products and versions are affected?: @dependencytrack/frontend (npm) SEMVER:introduced=0,fixed=4.6.1.
Is there a fix for CVE-2022-39350?: Yes. @dependencytrack/frontend (npm): upgrade to 4.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39350 attacked?: It is attacked over the network.
Am I affected by CVE-2022-39350?: Check whether you run @dependencytrack/frontend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@dependencytrack/frontend (npm): upgrade to 4.6.1 or later
```
npm install @dependencytrack/frontend@4.6.1
```

Technical details

This is a persistent cross-site scripting (XSS) vulnerability in the Dependency-Track Frontend's vulnerability details rendering. The application uses the Showdown JavaScript library to render markdown-formatted vulnerability descriptions, but fails to encode or sanitize the library's HTML output, which lacks built-in XSS protections. An attacker with VULNERABILITY_MANAGEMENT permission can inject arbitrary JavaScript via the Description, Details, Recommendation, or References fields when creating or editing a custom vulnerability. The payload executes in the context of any user with VIEW_PORTFOLIO permission who visits the modified vulnerability page. While vulnerability data from upstream sources (NVD, GitHub Advisories, OSV, etc.) could theoretically carry malicious payloads, the advisory indicates this has not been observed in practice. The vulnerability was patched in version 4.6.1.

Affected products

Dependency-Track Frontend before 4.6.1

Identifiers

CVE-2022-39350
GHSA-c33w-pm52-mqvf

Timeline

2022-10-25: disclosed
2022-10-25: patched: Fixed in version 4.6.1

References

https://github.com/DependencyTrack/frontend/security/advisories/GHSA-c33w-pm52-mqvf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.