CVE-2022-24710

    Dashboard / Vulnerabilities / CVE-2022-24710

    CVE-2022-24710

    Published: 25 Feb 2022Last Modified: 12 Aug 2026

    Summary: Cross-site Scripting in Weblate

    Details: Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24710.json, https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66, https://nvd.nist.gov/vuln/detail/CVE-2022-24710, https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389, https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1, https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bda

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8ff7be0b7e90d6118441bfcb6e9397dae7398ca8

    Affected versions

    weblate-4.10.1
    weblate-4.10

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24710 | CVE-DB