CVE-2022-24710 - CVE House
Back to Database
Status published Medium CVE-2022-24710

Cross-site Scripting in Weblate

Vulnerability Description

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24710

Credits & Attribution

No credits recorded in the NVD database.

References

More from WeblateOrg

View All →
CVE-2025-68398
Weblate has git config file overwrite vulnerability that leads to remote code execution
Critical 9.1
CVE-2025-68279
Weblate has an arbitrary file read via symbolic links
High 7.7
CVE-2025-67715
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Medium 4.3
CVE-2025-67492
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Medium 5.3
CVE-2025-66407
Weblate has Server-Side Request Forgery vulnerability
Medium 5

Affected Vendor

Affected Software

weblate
Vulnerable Versions:
< 4.11

Timeline

Official Publish: February 25th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact