CVE-2022-31133 - CVE House

Back to Database

Status published Medium CVE-2022-31133

Cross site scripting in HumHub

5.9 CVSS

Vulnerability Description

HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31133

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from humhub

View All →

CFiles Unauthorized Folder/ZIP Access in Public Spaces

HumHub is vulnerable to XSS through its Meta Search component

Files: Potential for SQL Injection through File Browse and List Operations

Files is Vulnerable to Reflected Self-XSS through its File Move Functionality

Improper access control in humhub

Affected Vendor

humhub

View all reports →

Affected Software

humhub

Vulnerable Versions:

< 1.11.4

Timeline

Official Publish: July 7th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement