Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2022-0501: Beanstalk Console lets attackers inject malicious scripts
CVE-2022-0501 · published 4 years ago
Summary
The web interface of the Beanstalk Console package can take input from a user and send it back unchanged, allowing a malicious script to run in a visitor's browser. This could let attackers steal data or perform actions as the logged‑in user. Update the package to version 1.7.12 or later, or apply the provided patch, and ensure any user‑generated content is properly filtered.
What to do
- Update ptrofimov beanstalk_console to version 1.7.12.
- Update beanstalk_console_project beanstalk_console to version 1.7.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | ptrofimov | beanstalk_console |
< 1.7.12 Fix: upgrade to 1.7.12
|
| – | beanstalk_console_project | beanstalk_console |
< 1.7.12 cpe:2.3:a:beanstalk_console_project:beanstalk_console:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_console
Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0501 Vendor Advisory
- https://github.com/advisories/GHSA-gj85-pvp5-mvf9
- https://huntr.dev/bounties/9af1c35e-3f74-4c93-a241-e8be01335ec7 URL
- https://github.com/ptrofimov/beanstalk_console/commit/e351c8260ec1d3718d9e475ee5... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0501.j... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
8.6
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Feb 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta