Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-29485: Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via unspecified vectors.

CVE-2022-29485 · published 4 years ago

Summary

Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via unspecified vectors.

What to do

Update ss-proj shirasagi to version 1.14.3 or later.

Affected software

Vendor	Product	Affected versions
ss-proj	shirasagi	>= 1.0.0, < 1.14.3 1.15.0 `cpe:2.3:a:ss-proj:shirasagi::::::::`

Original advisory text

Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via unspecified vectors.

References

https://jvn.jp/en/jp/JVN32962443/index.html URL
https://www.ss-proj.org/ URL
https://www.ss-proj.org/support/843.html URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29485... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-29485 Vendor Advisory
https://github.com/shirasagi/shirasagi Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published14 Jun 2022

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-29485 · NVD

CVE-2022-29485 · OSV

Track software like this

Free during beta