CVE-2022-24864

    Dashboard / Vulnerabilities / CVE-2022-24864

    CVE-2022-24864

    Published: 20 Apr 2022Last Modified: 14 Oct 2025

    Summary: Malicious Javascript injection in OriginProtocol/origin-website

    Details: Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the [email protected]. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds.

    References: https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7, https://github.com/OriginProtocol/origin-website/pull/617, https://github.com/github/codeql/pull/7127

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High