Refine your search
18 vulnerabilities found for by Hallo Welt! GmbH
CVE-2026-25784 (GCVE-0-2026-25784)
Vulnerability from cvelistv5
Published
2026-10-23 08:54
Modified
2026-10-23 08:54
Severity ?
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VLAI Severity ?
EPSS score ?
CWE
Summary
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.
This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5.2.3 ≤ |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://hub.docker.com/r/bluespice/wiki",
"defaultStatus": "unaffected",
"modules": [
"Container bluespice/wiki"
],
"packageName": "bluespice/wiki",
"product": "BlueSpice",
"programFiles": [
"root-fs/app/conf/LocalSettings.php"
],
"repo": "https://github.com/hallowelt/docker-bluespice-wiki",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "5.2.7",
"status": "affected",
"version": "5.2.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image \u003ccode\u003ebluespice/wiki\u003c/code\u003e) allows privilege escalation. The default value of \u003ccode\u003e$mwsgTokenAuthenticatorServiceCIDR\u003c/code\u003e in the container\u0027s \u003ccode\u003eLocalSettings.php\u003c/code\u003e was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable \u003ccode\u003eWIKI_SERVICE_TOKEN_AUTH_ALLOWED\u003c/code\u003e was not set. An empty value disables the IP restriction in the token authenticator component (\u003ccode\u003emwstake/mediawiki-component-token-authenticator\u003c/code\u003e). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\u003cp\u003eThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.\u003c/p\u003e"
}
],
"value": "Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container\u0027s LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "Scored for wikis that allow anonymous read access, where no privileges are required. In the default (non-public) BlueSpice configuration, reading the wiki requires a login (PR:L; CVSS 4.0: 8.7 / CVSS 3.1: 8.8, HIGH)."
},
"type": "Note"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:54:57.880Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created."
}
],
"value": "Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Set the environment variable \u003ccode\u003eWIKI_SERVICE_TOKEN_AUTH_ALLOWED\u003c/code\u003e of the wiki containers to the CIDR of the internal container network, or deny access to the REST path \u003ccode\u003e/rest.php/mws/v1/app-token/generate\u003c/code\u003e on the reverse proxy."
}
],
"value": "Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy."
}
],
"x_generator": {
"engine": "Hallo Welt! CERT"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2026-25784",
"datePublished": "2026-10-23T08:54:57.880Z",
"dateReserved": "2026-02-06T14:21:19.086Z",
"dateUpdated": "2026-10-23T08:54:57.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25716 (GCVE-0-2026-25716)
Vulnerability from cvelistv5
Published
2026-10-23 08:53
Modified
2026-10-29 01:52
Severity ?
7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.
This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5.0.0 ≤ Version: 5.2.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:40:46.901774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T01:52:06.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/wikimedia/mediawiki-extensions-BlueSpiceUserManager",
"defaultStatus": "unaffected",
"packageName": "Extension:BlueSpiceUserManager",
"product": "BlueSpice",
"programFiles": [
"src/UserManager.php",
"src/Rest/BlockUsersHandler.php",
"src/Rest/UnblockUsersHandler.php"
],
"programRoutines": [
{
"name": "BlueSpice\\UserManager\\UserManager::blockUser"
},
{
"name": "BlueSpice\\UserManager\\UserManager::unblockUser"
}
],
"repo": "https://gerrit.wikimedia.org/r/mediawiki/extensions/BlueSpiceUserManager",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "5.1.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "5.2.7",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kta1kri"
}
],
"datePublic": "2026-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints \u003ccode\u003e/bs-usermanager/v1/block/create\u003c/code\u003e and \u003ccode\u003e/bs-usermanager/v1/block/delete\u003c/code\u003e call \u003ccode\u003eUserManager::blockUser()\u003c/code\u003e and \u003ccode\u003eUserManager::unblockUser()\u003c/code\u003e, which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\u003cp\u003eThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\n\nThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:56:11.231Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to BlueSpice 5.1.11 or 5.2.7 or later."
}
],
"value": "Update to BlueSpice 5.1.11 or 5.2.7 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Deny access to the REST paths \u003ccode\u003e/rest.php/bs-usermanager/v1/block/create\u003c/code\u003e and \u003ccode\u003e/rest.php/bs-usermanager/v1/block/delete\u003c/code\u003e on the web server or reverse proxy. Note that this also disables enabling/disabling users from Special:UserManager."
}
],
"value": "Deny access to the REST paths /rest.php/bs-usermanager/v1/block/create and /rest.php/bs-usermanager/v1/block/delete on the web server or reverse proxy. Note that this also disables enabling/disabling users from Special:UserManager."
}
],
"x_generator": {
"engine": "Hallo Welt! CERT"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2026-25716",
"datePublished": "2026-10-23T08:53:47.208Z",
"dateReserved": "2026-02-06T14:21:19.094Z",
"dateUpdated": "2026-10-29T01:52:06.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24732 (GCVE-0-2026-24732)
Vulnerability from cvelistv5
Published
2026-03-04 12:13
Modified
2026-03-04 14:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.
HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5.1 ≤ 5.1.3 Version: 5.2 ≤ 5.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T14:26:52.232334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T14:27:00.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Extension:NSFileRepo"
],
"packageName": "Extension:NSFileRepo",
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "5.1.3",
"status": "affected",
"version": "5.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.0",
"status": "affected",
"version": "5.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-09-18T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.\u003cp\u003eThis issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.\u003c/p\u003e\u003cp\u003eHINT: Versions provided apply to BlueSpice MediaWiki releases. For\u0026nbsp;Extension:NSFileRepo the affected versions are 3.0 \u0026lt; 3.0.5\u003c/p\u003e"
}
],
"value": "Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.\n\nHINT: Versions provided apply to BlueSpice MediaWiki releases. For\u00a0Extension:NSFileRepo the affected versions are 3.0 \u003c 3.0.5"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
},
{
"capecId": "CAPEC-395",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-395 Bypassing Electronic Locks and Access Controls"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/RE:L",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552 Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T13:09:58.832Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper permission checks in Extension:NSFileRepo",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Make sure\u0026nbsp;\u003ccode\u003e\u003ccode\u003e$wgGroupPermissions[\u0027*\u0027][\u0027read\u0027]\u003c/code\u003e\u003c/code\u003e\u003ccode\u003e\u003c/code\u003e is set to \u003ccode\u003efalse\u003c/code\u003e in the\u0026nbsp; \u003ccode\u003eLocalSettings.php\u003c/code\u003e."
}
],
"value": "Make sure\u00a0$wgGroupPermissions[\u0027*\u0027][\u0027read\u0027] is set to false in the\u00a0 LocalSettings.php."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2026-24732",
"datePublished": "2026-03-04T12:13:09.918Z",
"dateReserved": "2026-02-06T14:21:19.100Z",
"dateUpdated": "2026-03-04T14:27:00.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-58114 (GCVE-0-2025-58114)
Vulnerability from cvelistv5
Published
2025-09-19 13:10
Modified
2025-09-19 13:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5 ≤ 5.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-58114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T13:55:47.848998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:55:52.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Extension:CognitiveProcessDesigner"
],
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-09-18T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).\u003cp\u003eThis issue affects BlueSpice: from 5 through 5.1.1.\u003c/p\u003e"
}
],
"value": "Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:10:38.231Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Potential XSS in Extension:CognitiveProcessDesigner",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2025-58114",
"datePublished": "2025-09-19T13:10:38.231Z",
"dateReserved": "2025-09-18T12:55:40.990Z",
"dateUpdated": "2025-09-19T13:55:52.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-57880 (GCVE-0-2025-57880)
Vulnerability from cvelistv5
Published
2025-09-19 13:10
Modified
2025-09-19 13:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Summary
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5 ≤ 5.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-57880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T13:56:28.180417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:56:35.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Extension:BlueSpiceWhoIsOnline"
],
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-09-18T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).\u003cbr\u003e\u003cp\u003eThis issue affects BlueSpice: from 5 through 5.1.1.\u003c/p\u003e"
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).\nThis issue affects BlueSpice: from 5 through 5.1.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:10:12.916Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Potential XSS in Extension:BlueSpiceWhoIsOnline",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2025-57880",
"datePublished": "2025-09-19T13:10:12.916Z",
"dateReserved": "2025-09-18T12:55:41.004Z",
"dateUpdated": "2025-09-19T13:56:35.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-48007 (GCVE-0-2025-48007)
Vulnerability from cvelistv5
Published
2025-09-19 13:09
Modified
2025-09-19 14:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Summary
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5 ≤ 5.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T14:03:47.417130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T14:03:52.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Extension:BlueSpiceAvatars"
],
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-09-18T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).\u003cbr\u003e\u003cp\u003eThis issue affects BlueSpice: from 5 through 5.1.1.\u003c/p\u003e"
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).\nThis issue affects BlueSpice: from 5 through 5.1.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:09:47.243Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Potential XSS in Extension:BlueSpiceAvatars",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2025-48007",
"datePublished": "2025-09-19T13:09:47.243Z",
"dateReserved": "2025-09-18T12:55:40.980Z",
"dateUpdated": "2025-09-19T14:03:52.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-46703 (GCVE-0-2025-46703)
Vulnerability from cvelistv5
Published
2025-09-19 13:09
Modified
2025-09-19 14:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Summary
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 5 ≤ 5.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-46703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T14:04:09.185999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T14:04:13.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Extension:AtMentions"
],
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-09-18T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).\u003cbr\u003e\u003cp\u003eThis issue affects BlueSpice: from 5 through 5.1.1.\u003c/p\u003e"
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).\nThis issue affects BlueSpice: from 5 through 5.1.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T13:09:20.143Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Potential XSS in Extension:AtMentions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2025-46703",
"datePublished": "2025-09-19T13:09:20.143Z",
"dateReserved": "2025-09-18T12:55:40.967Z",
"dateUpdated": "2025-09-19T14:04:13.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42431 (GCVE-0-2023-42431)
Vulnerability from cvelistv5
Published
2023-10-30 10:48
Modified
2024-09-06 18:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 Version: 3 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:51.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2023-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T17:46:32.394405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T18:06:33.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThanOrEqual": "4.3.2",
"status": "affected",
"version": "4",
"versionType": "major"
},
{
"lessThanOrEqual": "3.2.10",
"status": "affected",
"version": "3",
"versionType": "major"
}
]
}
],
"datePublic": "2023-10-30T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context."
}
],
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-30T10:50:52.614Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2023-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Potential XSS on user preferences page",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2023-42431",
"datePublished": "2023-10-30T10:48:21.487Z",
"dateReserved": "2023-10-16T14:12:02.578Z",
"dateUpdated": "2024-09-06T18:06:33.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42001 (GCVE-0-2022-42001)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 15:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the book navigation.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:39.262Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-05"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T15:50:49.191106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T15:51:06.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the book navigation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-05"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-05",
"discovery": "INTERNAL"
},
"title": "Potential XSS in book navigation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-42001",
"datePublished": "2022-11-15T14:24:50.942Z",
"dateReserved": "2022-10-07T00:00:00.000Z",
"dateUpdated": "2025-04-29T15:51:06.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42000 (GCVE-0-2022-42000)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-28 20:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:39.159Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T20:13:34.382348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T20:13:51.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-04",
"discovery": "INTERNAL"
},
"title": "Potential XSS in comment section",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-42000",
"datePublished": "2022-11-15T14:24:50.697Z",
"dateReserved": "2022-10-07T00:00:00.000Z",
"dateUpdated": "2025-04-28T20:13:51.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41814 (GCVE-0-2022-41814)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 19:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the history view of a wikipage.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:37.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T19:13:31.891802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T19:13:52.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the history view of a wikipage."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-04",
"discovery": "INTERNAL"
},
"title": "Potential XSS in history view",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-41814",
"datePublished": "2022-11-15T14:24:50.408Z",
"dateReserved": "2022-10-07T00:00:00.000Z",
"dateUpdated": "2025-04-29T19:13:52.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41789 (GCVE-0-2022-41789)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 20:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:43.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:08:50.836561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:08:57.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-04"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-04",
"discovery": "INTERNAL"
},
"title": "Potential XSS on default page header",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-41789",
"datePublished": "2022-11-15T14:24:50.166Z",
"dateReserved": "2022-10-07T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:08:57.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41611 (GCVE-0-2022-41611)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 20:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:49:43.430Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:09:09.513696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:09:18.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-03"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-03",
"discovery": "INTERNAL"
},
"title": "Potential XSS on sidebar navigation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-41611",
"datePublished": "2022-11-15T14:24:49.902Z",
"dateReserved": "2022-10-07T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:09:18.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3958 (GCVE-0-2022-3958)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 20:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:27:53.105Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3958",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:09:32.401312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:09:39.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-07",
"discovery": "INTERNAL"
},
"title": "Potential XSS on personal menu navigation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-3958",
"datePublished": "2022-11-15T14:24:49.568Z",
"dateReserved": "2022-11-11T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:09:39.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3895 (GCVE-0-2022-3895)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 18:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | Common User Interface Component |
Version: 3 < 3.0.5 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:20:58.454Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T18:11:00.732213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T18:12:08.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Common User Interface Component",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "3.0.5",
"status": "affected",
"version": "3",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Common User Interface 3.0.5 or later. This is included in BlueSpice 4.2.1 or later."
}
],
"source": {
"advisory": "BSSA-2022-08",
"discovery": "INTERNAL"
},
"title": "Potential XSS in common user interface component library",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-3895",
"datePublished": "2022-11-15T14:24:49.235Z",
"dateReserved": "2022-11-08T00:00:00.000Z",
"dateUpdated": "2025-04-29T18:12:08.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3893 (GCVE-0-2022-3893)
Vulnerability from cvelistv5
Published
2022-11-15 14:24
Modified
2025-04-29 20:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.2.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:20:58.777Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-06"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:12:31.200455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:12:41.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-06"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.2.1 or later"
}
],
"source": {
"advisory": "BSSA-2022-06",
"discovery": "INTERNAL"
},
"title": "Potential XSS on custom menu navigation",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-3893",
"datePublished": "2022-11-15T14:24:48.875Z",
"dateReserved": "2022-11-08T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:12:41.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2510 (GCVE-0-2022-2510)
Vulnerability from cvelistv5
Published
2022-07-22 15:57
Modified
2024-09-16 16:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.1.1 Version: 3 < 3.2.9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:39:07.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.1.1",
"status": "affected",
"version": "4",
"versionType": "custom"
},
{
"lessThan": "3.2.9",
"status": "affected",
"version": "3",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-01-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in \"Extension:ExtendedSearch\" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page \"Special:SearchCenter\", using the search term in the URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-22T15:57:13.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-01"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to BlueSpice 3.2.9, 4.1.1 or higher"
}
],
"source": {
"advisory": "BSSA-2022-01",
"discovery": "EXTERNAL"
},
"title": "Potential XSS on Special:SearchCenter",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@bluespice.com",
"DATE_PUBLIC": "2022-01-31T11:00:00.000Z",
"ID": "CVE-2022-2510",
"STATE": "PUBLIC",
"TITLE": "Potential XSS on Special:SearchCenter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BlueSpice",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "4",
"version_value": "4.1.1"
},
{
"version_affected": "\u003c",
"version_name": "3",
"version_value": "3.2.9"
}
]
}
}
]
},
"vendor_name": "Hallo Welt! GmbH"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) vulnerability in \"Extension:ExtendedSearch\" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page \"Special:SearchCenter\", using the search term in the URL."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-01",
"refsource": "CONFIRM",
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-01"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to BlueSpice 3.2.9, 4.1.1 or higher"
}
],
"source": {
"advisory": "BSSA-2022-01",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-2510",
"datePublished": "2022-07-22T15:57:13.504Z",
"dateReserved": "2022-07-22T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:38:23.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2511 (GCVE-0-2022-2511)
Vulnerability from cvelistv5
Published
2022-07-22 15:56
Modified
2024-09-17 01:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-site Scripting (XSS)
Summary
Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice |
Version: 4 < 4.1.3 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:39:08.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BlueSpice",
"vendor": "Hallo Welt! GmbH",
"versions": [
{
"lessThan": "4.1.3",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-04-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) vulnerability in the \"commonuserinterface\" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-22T15:56:23.000Z",
"orgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"shortName": "HW"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.1.3 or later"
}
],
"source": {
"advisory": "BSSA-2022-02",
"discovery": "EXTERNAL"
},
"title": "Potential XSS in title URL parameter",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@bluespice.com",
"DATE_PUBLIC": "2022-04-25T10:00:00.000Z",
"ID": "CVE-2022-2511",
"STATE": "PUBLIC",
"TITLE": "Potential XSS in title URL parameter"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BlueSpice",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "4",
"version_value": "4.1.3"
}
]
}
}
]
},
"vendor_name": "Hallo Welt! GmbH"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) vulnerability in the \"commonuserinterface\" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-02",
"refsource": "CONFIRM",
"url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Upgrade to BlueSpice 4.1.3 or later"
}
],
"source": {
"advisory": "BSSA-2022-02",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ff95705b-1a40-4639-8017-a58fa868baee",
"assignerShortName": "HW",
"cveId": "CVE-2022-2511",
"datePublished": "2022-07-22T15:56:23.016Z",
"dateReserved": "2022-07-22T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:56:03.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}