CVE-2022-32173: OrchardCore HTML Injection Vulnerability
Summary
CVE-2022-32173: OrchardCore vulnerable to HTML injection. Affects OrchardCore versions >= 1.0.0-rc1-11259, < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OrchardCore is an open-source content management system (CMS) built on the ASP.NET Core framework. It provides a modular and extensible platform for creating websites, blogs, and applications. The CMS allows users to manage content, customize layouts, and add functionality through a wide range of modules and themes. However, versions prior to 1.4.0 are vulnerable to HTML injection.
Vulnerability Detail
The HTML injection vulnerability in OrchardCore allows an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard. This injected code can affect admin users and potentially lead to various security risks. The vulnerability has a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). It is classified as CWE-79, which refers to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patch by upgrading to OrchardCore version 1.4.0 or later.
Conclusion
OrchardCore versions prior to 1.4.0 are vulnerable to HTML injection, which can be exploited by authenticated users with an editor security role. The recommended solution is to upgrade to OrchardCore version 1.4.0 or later, which includes a patch for this vulnerability. It is crucial to keep software and dependencies up to date to mitigate security risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for OrchardCore →
FAQ
OrchardCore is an open-source content management system (CMS) built on the ASP.NET Core framework. It provides a modular and extensible platform for creating websites, blogs, and applications.
OrchardCore versions prior to 1.4.0 are affected by this HTML injection vulnerability. Specifically, authenticated users with an editor security role can exploit this vulnerability.
The vulnerability allows an attacker to inject malicious HTML code into the dashboard, affecting admin users. This can lead to various security risks, including cross-site scripting (XSS) attacks and unauthorized access to sensitive information.
Yes, the vulnerability can be fixed by upgrading OrchardCore to version 1.4.0 or later. The latest version includes a patch that addresses the HTML injection issue.
No, there are no known workarounds for this vulnerability. It is essential to apply the official patch by upgrading to OrchardCore version 1.4.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for OrchardCore.
