CVE-2022-23543 - CVE House
Back to Database
Status published Medium CVE-2022-23543

HTML attributes when attaching a YouTube link to the post

Vulnerability Description

Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert("xss")`) to the `<iframe>'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23543

Credits & Attribution

No credits recorded in the NVD database.

References

More from mesosoi

View All →
CVE-2023-40182
silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not
Low 3.7
CVE-2023-40179
Silverware Games vulnerable to account enumeration via inconsistent responses
Medium 5.3
CVE-2023-29192
SilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developers
Low 2.7
CVE-2022-36072
SilverwareGames.io used == for hashing instead of ===
Medium 5.9

Affected Vendor

Affected Software

silverwaregames-io-issue-tracker
Vulnerable Versions:
< 1.1.34

Timeline

Official Publish: December 19th, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-80

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact