{"id":"CVE-2022-3958","state":"PUBLISHED","title":"Potential XSS on personal menu navigation","description":"Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.","publishedAt":"2022-11-15T14:24:49.568Z","updatedAt":"2025-04-29T20:09:39.611Z","severity":{"score":3.3,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"HW"},"assigner":"HW","products":["Hallo Welt! GmbH BlueSpice"],"affected":[{"vendor":"Hallo Welt! GmbH","product":"BlueSpice","versions":[{"version":"4","status":"affected","lessThan":"4.2.1","versionType":"custom"}]}],"references":["https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:50:32.060Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/3xxx/CVE-2022-3958.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-3958","state":"PUBLISHED","datePublished":"2022-11-15T14:24:49.568Z","dateUpdated":"2025-04-29T20:09:39.611Z","assignerShortName":"HW","assignerOrgId":"ff95705b-1a40-4639-8017-a58fa868baee","dateReserved":"2022-11-11T00:00:00.000Z"},"containers":{"cna":{"title":"Potential XSS on personal menu navigation","descriptions":[{"lang":"en","value":"Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks."}],"affected":[{"vendor":"Hallo Welt! GmbH","product":"BlueSpice","versions":[{"version":"4","status":"affected","lessThan":"4.2.1","versionType":"custom"}]}],"references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Cross-site Scripting (XSS)"}]}],"providerMetadata":{"shortName":"HW","orgId":"ff95705b-1a40-4639-8017-a58fa868baee","dateUpdated":"2022-11-15T00:00:00.000Z"},"datePublic":"2022-11-15T00:00:00.000Z","x_generator":{"engine":"Vulnogram 0.0.9"},"source":{"advisory":"BSSA-2022-07","discovery":"INTERNAL"},"solutions":[{"lang":"en","value":"Upgrade to BlueSpice 4.2.1 or later"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:27:53.105Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-29T20:09:32.401312Z","id":"CVE-2022-3958","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-29T20:09:39.611Z"}}]}}}