CVE-2022-24717

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Finastra	ssr-pages	< 0.1.5

References

https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/pull/2Issue Tracking, Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/security/advisories/GHSA-7f63-h6g3-7cwmPatch, Third Party Advisory
https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/pull/2Issue Tracking, Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5Patch, Third Party Advisory
https://github.com/Finastra/ssr-pages/security/advisories/GHSA-7f63-h6g3-7cwmPatch, Third Party Advisory

Timeline

Published: Mar 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247186.5ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occ CVE-2022-247196.1Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of CVE-2022-24725.5Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents o CVE-2022-247209.8image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` meth CVE-2022-247218.1CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Se CVE-2022-247226.1VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripti CVE-2022-247235.3URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol CVE-2022-247249.8cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an CVE-2022-247255.5Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix sys CVE-2022-247267.5Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable CVE-2022-247285.4CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module CVE-2022-247297.5CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dia