CVE-2022-37720
Published on: Not Yet Published
Last Modified on: 11/29/2022 10:06:00 PM UTC
Certain versions of Orchard Cms from Orchardcore contain the following vulnerability:
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.
- CVE-2022-37720 has been assigned by
[email protected] to track the vulnerability - currently rated as CRITICAL severity.
CVSS3 Score: 9 - CRITICAL
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | REQUIRED |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| CHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| CVE-2022-37720 - Stored Cross-Site Scripting in OrchardCMS | INTEGRITY Labs | labs.integrity.pt text/html |
MISC labs.integrity.pt/advisories/cve-2022-37720/ |
| Orchard | Buy your next home before you sell | orchard.com text/html |
MISC orchard.com |
| OP Home - The Orchard Project | orchardproject.com text/html |
MISC orchardproject.com |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Orchardcore | Orchard Cms | 1.10.3 | All | All | All |
- cpe:2.3:a:orchardcore:orchard_cms:1.10.3:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2022-37720 : Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting #XSS . When a low privile… twitter.com/i/web/status/1… | 2022-11-25 16:04:45 |
 /r/netcve |
CVE-2022-37720 | 2022-11-25 17:38:23 |