CVE-2022-31133
MEDIUM
Published Jul 7, 20223y ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Published Jul 7, 2022 3y ago
Last Modified Jun 17, 2026 2w ago
Description
HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 2
References 4
- github.com https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157cae
- github.com https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1
- github.com https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959c
- huntr.dev https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76
Remediation
- github.com https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157cae
- github.com https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1