CVE-2022-30429
Neos CMS vulnerable to XSS in various backend modules
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
CVE-2022-30429- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
CVE-2022-30429- Updated
- 2026-11-02
EUVDEUVD-2022-5982 No score
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
EUVD-2022-5982- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7m9h-v68w-pfw3
Neos CMS vulnerable to XSS in various backend modules
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
GHSA-7m9h-v68w-pfw3- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-7m9h-v68w-pfw3
Neos CMS vulnerable to XSS in various backend modules
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
GHSA-7m9h-v68w-pfw3- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-neos-2022-30429 No score
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
BIT-neos-2022-30429- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
- Record
CVE-2022-30429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neos/neosPackagist |
3.3.0 up to 4.4.0 | 4.4.0 |
neos/neosPackagist |
5.3.0 up to 5.3.10 | 5.3.10 |
neos/neosPackagist |
7.0.0 up to 7.0.9 | 7.0.9 |
neos/neosPackagist |
7.1.0 up to 7.1.7 | 7.1.7 |
neos/neosPackagist |
7.2.0 up to 7.2.6 | 7.2.6 |
neos/neosPackagist |
7.3.0 up to 7.3.4 | 7.3.4 |
neos/neosPackagist |
8.0.0 up to 8.0.2 | 8.0.2 |
neosBitnami |
3.3.0 up to 5.3.10, 7.0.0 up to 7.0.9, 7.1.0 up to 7.1.7, 7.2.0 up to 7.2.6, 7.3.0 up to 7.3.4, 8.0.0 up to 8.0.2 | 5.3.107.0.97.1.77.2.67.3.48.0.2 |
neos/neosPackagist |
3.3.0 up to 4.4.0, plus listed versions 3.3.13.3.103.3.113.3.123.3.13 Show 45 moreShow less3.3.143.3.153.3.163.3.173.3.183.3.193.3.23.3.203.3.213.3.223.3.233.3.243.3.253.3.263.3.273.3.283.3.293.3.33.3.43.3.53.3.63.3.73.3.83.3.94.0.04.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.164.0.174.0.184.0.194.0.24.0.204.0.214.0.224.0.234.0.34.0.44.0.54.0.6 |
4.4.0 |
neos/neosPackagist |
5.3.0 up to 5.3.10, plus listed versions 5.3.15.3.25.3.35.3.45.3.5 Show 4 moreShow less5.3.65.3.75.3.85.3.9 |
5.3.10 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
neos/neosPackagist |
7.0.0 up to 7.0.9, plus listed versions 7.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.8 |
7.0.9 |
neos/neosPackagist |
7.1.0 up to 7.1.7, plus listed versions 7.1.17.1.27.1.37.1.47.1.57.1.6 |
7.1.7 |
neos/neosPackagist |
7.2.0 up to 7.2.6, plus listed versions 7.2.17.2.27.2.37.2.47.2.5 |
7.2.6 |
neos/neosPackagist |
7.3.0 up to 7.3.4, plus listed versions 7.3.17.3.27.3.3 |
7.3.4 |
neos/neosPackagist |
8.0.0 up to 8.0.2, plus listed versions 8.0.1 |
8.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30429 is a medium vulnerability (CVSS 5.4) in Neos Cms, published June 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in neos/neos 4.4.0.
References
neos.io/blog/xss-in-various-backend-modules.html
it-sec.de/unbekannte-schwachstellen-in-neos-cms
nvd.nist.gov/vuln/detail/CVE-2022-30429
github.com/FriendsOfPHP/security-advisories/blob/master/neos/neos/CVE-2022-30429.yaml
Left out here: 65 versions. The JSON record has them.