Moderate severityNVD Advisory· Published Nov 21, 2022· Updated Apr 14, 2025

Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

CVE-2022-4105

Description

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
kiwitcmsPyPI	< 11.6	11.6

Affected products

ghsa-coords
pkg:pypi/kiwitcms
Range: < 11.6
Kiwitcms/Kiwi TCMScpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hf94-8mx5-2vvjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-4105ghsaADVISORY
github.com/kiwitcms/kiwi/commit/a2b169ffdef1d7c1755bade8138578423b35011bghsaWEB
huntr.dev/bounties/386417e9-0cd5-4d80-8137-b0fd5c30b8f8ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000