CVE-2022-43706

5.4 mediumEPSS 0.4%

Medium (5.4) in stackstorm stackstorm. EPSS 0.4% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-12-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stackstorm:stackstorm

References

https://stackstorm.com/2022/12/v3-8-0-released/
https://stackstorm.com/2022/12/v3-8-0-released/

Check your stack JSON