Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24710

CVE-2022-24710: Cross-site Scripting in Weblate

5.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24710
GHSA ID
GHSA-6jp6-9rf9-gc66
EPSS Score
0.52405%
CWE
CWE-79
Published
2/25/2022
Updated
11/19/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
Weblatepip< 4.114.11

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing output encoding in 4 key areas: 1) Report generation functions (get_credits/get_counts) failed to escape user-controlled data. 2) Translation form rendering didn't escape language names. 3) Username autocomplete directly injected unescaped strings. The patches explicitly add HTML escaping (via Django's escape() and DOM text node creation) in these specific locations, confirming these were the vulnerable entry points. The CWE-79 classification and commit messages directly correlate to XSS via user/language name inputs in these components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *u* to improp*r n*utr*liz*tion, it w*s possi*l* to p*r*orm *ross-sit* s*riptin* vi* *r**t** us*r *n* l*n*u*** n*m*s. ### P*t***s T** issu*s w*r* *ix** in t** *.** r*l**s*. T** *ollowin* *ommits *r* ***r*ssin* it: * *********************

Reasoning

T** vuln*r**ility st*ms *rom missin* output *n*o*in* in * k*y *r**s: *) R*port **n*r*tion *un*tions (**t_*r**its/**t_*ounts) **il** to *s**p* us*r-*ontroll** **t*. *) Tr*nsl*tion *orm r*n**rin* *i*n't *s**p* l*n*u*** n*m*s. *) Us*rn*m* *uto*ompl*t* *