CVE-2022-24918: fedoraproject fedora Cross-site Scripting
Vulnerability summary
CVE-2022-24918 is a medium (CVSS 4.4) Cross-site Scripting vulnerability in fedoraproject fedora. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 66.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 09-03-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.16%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- zabbix< 1:6.0.7+dfsg-2
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Ubuntu1 product
- zabbixAll versions (No fix recorded)
Zabbix1 product
- frontend5.0.0-5.0.20 | 5.4.0-5.4.10 | 6.0 | ≥ 5.0.0, ≤ 5.0.20 | ≥ 5.4.0, ≤ 5.4.10 | 6.0.0
4 vendors · 4 products
