CVE-2022-22123

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
halo-dev	halo	>= v1.0.0, < unspecified; >= unspecified, <= v1.4.17

References

https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391Release Notes, Third Party Advisory
https://github.com/halo-dev/halo/issues/1557Issue Tracking, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22123Exploit, Third Party Advisory
https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391Release Notes, Third Party Advisory
https://github.com/halo-dev/halo/issues/1557Issue Tracking, Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22123Exploit, Third Party Advisory

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221245.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated atta CVE-2022-221254.8In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin CVE-2022-221266.1Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScr CVE-2022-221277.2Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity CVE-2022-221289.8Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could CVE-2022-22135.4A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2022-221376.5A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malform CVE-2022-221387.5All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. CVE-2022-221397.3Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalati CVE-2022-22148.8A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unk CVE-2022-221409.8An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A spec CVE-2022-221417.8'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL c