CVE-2022-4455

Low

Description

A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.

SeverityLow

CVSS3.5

Exploit probability—

ProductPhp-calendar

PublishedDec 13, 2022

First seenDec 13, 2022

Weakness typeCWE-79Cross-site scripting (XSS)CWE-94Code injection

How to fix

Update

php-calendar php-calendar2022-04-28 or later

Patches

github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809

Affected products

Product	Affected versions	Fixed in
php-calendar php-calendar	v < 2022-04-28	2022-04-28

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.