CVE-2022-32173

    Dashboard / Vulnerabilities / CVE-2022-32173

    CVE-2022-32173

    Published: 3 Oct 2022Last Modified: 12 Aug 2026

    Summary: OrchardCore - HTML Injection

    Details: In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.

    References: https://www.mend.io/vulnerability-database/CVE-2022-32173, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32173.json, https://nvd.nist.gov/vuln/detail/CVE-2022-32173, https://github.com/OrchardCMS/OrchardCore/commit/0163c88ddeaca39815d7e6e5ea1c8391085cc136

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a5e171044cf9ad2418493922ed28f580227eba26
    Fixed -49cc18fcdeb409ec4ad71569a0e2d41a0d5cad17

    Affected versions

    v0.0.1
    v0.0.3
    v0.0.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-32173 | CVE-DB