CVE-2022-30278

    Dashboard / Vulnerabilities / CVE-2022-30278

    CVE-2022-30278

    Published: 10 May 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30278.json, https://nvd.nist.gov/vuln/detail/CVE-2022-30278, https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ca96c0fb9d8946ab26929e83edf029dd5df6d536

    Affected versions

    v2022.2.1
    v2022.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-30278 | CVE-DB