CVE-2022-24709 - CVE House
Back to Database
Status published High CVE-2022-24709

Cross site scripting in @awsui/components-react

Vulnerability Description

@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24709

Credits & Attribution

No credits recorded in the NVD database.

References

More from aws

View All →
CVE-2025-23206
IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
Low 1.8
CVE-2025-0508
MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk
Medium 5.9
CVE-2024-45037
AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template
Medium 6.4
CVE-2024-34073
Command Injection in sagemaker-python-sdk
High 7.8
CVE-2024-34072
Deserialization of Untrusted Data in sagemaker-python-sdk
High 7.8

Affected Vendor

Affected Software

awsui-documentation
Vulnerable Versions:
< 3.0.367

Timeline

Official Publish: February 24th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact