CVE-2022-4520— WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-4520
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the component Advanced Search. The manipulation of the argument mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 is able to address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对消息或数据结构的处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
WSO2 carbon-registry 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WSO2 carbon-registry是美国WSO2公司的一个平台。允许组织跟踪、管理和交易温室气体排放（GHG排放）。 WSO2 carbon-registry 4.8.11之前版本存在安全漏洞。攻击者利用该漏洞执行跨站点脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WSO2 | carbon-registry | 4.8.0 | - |
II. Public POCs for CVE-2022-4520
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-4520
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-4520 (1)
Other References for CVE-2022-4520 (1)
IV. Related Vulnerabilities
Same vendor: WSO2
- CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 P - CVE-2026-3415
XML External Entity (XXE) Injection via Schema Validation in - CVE-2025-14561
Access Control Bypass via Publisher REST APIs in Multiple WS - CVE-2025-12317
Improper Token Revocation via SOAP Services in Multiple WSO2 - CVE-2025-6508
User Interface Misrepresentation via Swagger UI Try-out Cons
Same weakness: CWE-707
- CVE-2026-4249
Denial of Service via Malicious JSON Payloads in Throttling - CVE-2025-66545
Nextcloud Groupfolders users with read-only permissions for - CVE-2025-26633
Microsoft Management Console Security Feature Bypass Vulnera - CVE-2024-43572
Microsoft Management Console Remote Code Execution Vulnerabi - CVE-2022-4729
Graphite Web Template Name cross site scripting
V. Comments for CVE-2022-4520
No comments yet