Vulnerability Details CVE-2022-46151
Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/server/app/auth/oauth_auth.py` and `querybook/server/app/auth/okta_auth.py`. This may allow attackers to perform reflected cross site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed. Users are advised to upgrade to the latest, patched version of querybook (version 3.14.2 or greater). Users unable to upgrade may enable CSP and not allow unsafe-inline or manually escape query parameters in a reverse proxy.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 23.2%
CVSS Severity
CVSS v3 Score 6.3
References
- https://github.com/pinterest/querybook/commit/88a7f10495bf5ed1a556ade51a2f2794e403c063
- https://github.com/pinterest/querybook/security/advisories/GHSA-mrrw-9wf7-xq6w
- https://github.com/pinterest/querybook/commit/88a7f10495bf5ed1a556ade51a2f2794e403c063
- https://github.com/pinterest/querybook/security/advisories/GHSA-mrrw-9wf7-xq6w
Products affected by CVE-2022-46151
-
cpe:2.3:a:pinterest:querybook:-
-
cpe:2.3:a:pinterest:querybook:2.3.0
-
cpe:2.3:a:pinterest:querybook:2.4.0
-
cpe:2.3:a:pinterest:querybook:2.8.0
-
cpe:2.3:a:pinterest:querybook:2.9.0
-
cpe:2.3:a:pinterest:querybook:3.0.0
-
cpe:2.3:a:pinterest:querybook:3.1.0
-
cpe:2.3:a:pinterest:querybook:3.1.1
-
cpe:2.3:a:pinterest:querybook:3.1.2
-
cpe:2.3:a:pinterest:querybook:3.13.0
-
cpe:2.3:a:pinterest:querybook:3.2.0
-
cpe:2.3:a:pinterest:querybook:3.4.0
-
cpe:2.3:a:pinterest:querybook:3.5.0
-
cpe:2.3:a:pinterest:querybook:3.6.0