{"id":"CVE-2022-24710","aliases":["BIT-weblate-2022-24710","EUVD-2022-0362","GHSA-6jp6-9rf9-gc66","PYSEC-2022-35","openSUSE-SU-2024:11887-1"],"status":"published","title":"Cross-site Scripting in Weblate","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00753,"percentile":0.55325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-02-25T20:50:11Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"PyPI","package":"weblate","fixed_in":["4.11"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"weblate","fixed_in":["4.11.0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"weblate","fixed_in":["4.11-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"weblate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"weblate","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.11.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"weblate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11"}]}],"versions":["1.9","2.0","2.1","2.10","2.10.1","2.11","2.12","2.13","2.13.1","2.14","2.14.1","2.15","2.16","2.17","2.17.1","2.18","2.19","2.19.1","2.2","2.20","2.3","2.4","2.5","2.6","2.7","2.8","2.9","3.0","3.0.1","3.1","3.1.1","3.10","3.10.1","3.10.2","3.10.3","3.11","3.11.1","3.11.2","3.11.3","3.2","3.2.1","3.2.2","3.3","3.4","3.5","3.5.1","3.6","3.6.1","3.7","3.7.1","3.8","3.9","3.9.1","4.0","4.0.1","4.0.2","4.0.3","4.0.4","4.1","4.1.1","4.10","4.10.1","4.2","4.2.1","4.2.2","4.3","4.3.1","4.3.2","4.4","4.4.1","4.4.2","4.5","4.5.1","4.5.2","4.5.3","4.6","4.6.1","4.6.2","4.7","4.7.1","4.7.2","4.8","4.8.1","4.9","4.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"weblate","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"f6753a1a1c63fade6ad418fbda827c6750ab0bda"},{"fixed":"9e19a8414337692cc90da2a91c9af5420f2952f1"},{"fixed":"22d577b1f1e88665a88b4569380148030e0f8389"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11"}]}],"versions":["1.9","2.0","2.1","2.10","2.10.1","2.11","2.12","2.13","2.13.1","2.14","2.14.1","2.15","2.16","2.17","2.17.1","2.18","2.19","2.19.1","2.2","2.20","2.3","2.4","2.5","2.6","2.7","2.8","2.9","3.0","3.0.1","3.1","3.1.1","3.10","3.10.1","3.10.2","3.10.3","3.11","3.11.1","3.11.2","3.11.3","3.2","3.2.1","3.2.2","3.3","3.4","3.5","3.5.1","3.6","3.6.1","3.7","3.7.1","3.8","3.9","3.9.1","4.0","4.0.1","4.0.2","4.0.3","4.0.4","4.1","4.1.1","4.10","4.10.1","4.2","4.2.1","4.2.2","4.3","4.3.1","4.3.2","4.4","4.4.1","4.4.2","4.5","4.5.1","4.5.2","4.5.3","4.6","4.6.1","4.6.2","4.7","4.7.1","4.7.2","4.8","4.8.1","4.9","4.9.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"weblate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11-1.1"}]}]}],"products":[{"vendor":"weblate","product":"weblate"},{"vendor":"weblateorg","product":"weblate"}],"references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web","advisory"]},{"url":"https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bda","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24710","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2022-35.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6jp6-9rf9-gc66"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24710.json","tags":["advisory"]},{"url":"https://github.com/WeblateOrg/weblate","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24710","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-24710","title":"Cross-site Scripting in Weblate","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2022-02-25T20:50:11Z","modified":"2025-04-23T19:00:28.349Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-0362","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2022-02-25T20:50:11Z","modified":"2025-04-23T19:00:28Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:07.453218Z"}],"ghsa":[{"id":"GHSA-6jp6-9rf9-gc66","title":"Cross-site Scripting in Weblate","description":"### Impact\nDue to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.\n\n### Patches\n\nThe issues were fixed in the 4.11 release. The following commits are addressing it:\n\n* f6753a1a1c63fade6ad418fbda827c6750ab0bda\n* 9e19a8414337692cc90da2a91c9af5420f2952f1\n* 22d577b1f1e88665a88b4569380148030e0f8389\n\n### Workarounds\n\nYou can look for crafted user and language names to see if you were affected.\n\n### References\n* https://hackerone.com/reports/1486674\n* https://hackerone.com/reports/1486718\n* https://hackerone.com/reports/1485226\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)\n* Email us at [care@weblate.org](mailto:care@weblate.org)","status":"published","published":"2022-02-25T22:18:50Z","modified":"2024-11-19T18:28:08Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2022-24710","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2022-02-25T21:15:08.2Z","modified":"2026-06-17T04:32:20.737Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"CVE-2022-24710","title":"Cross-site Scripting in Weblate","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2022-02-25T20:50:11Z","modified":"2026-10-28T02:30:39.295276315Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-6jp6-9rf9-gc66","title":"Cross-site Scripting in Weblate","description":"### Impact\nDue to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.\n\n### Patches\n\nThe issues were fixed in the 4.11 release. The following commits are addressing it:\n\n* f6753a1a1c63fade6ad418fbda827c6750ab0bda\n* 9e19a8414337692cc90da2a91c9af5420f2952f1\n* 22d577b1f1e88665a88b4569380148030e0f8389\n\n### Workarounds\n\nYou can look for crafted user and language names to see if you were affected.\n\n### References\n* https://hackerone.com/reports/1486674\n* https://hackerone.com/reports/1486718\n* https://hackerone.com/reports/1485226\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)\n* Email us at [care@weblate.org](mailto:care@weblate.org)","status":"published","published":"2022-02-25T22:18:50Z","modified":"2024-11-19T18:54:30.496324Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"BIT-weblate-2022-24710","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2024-03-06T11:08:18.098Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"openSUSE-SU-2024:11887-1","title":"weblate-4.11-1.1 on GA media","description":"These are all security issues fixed in the weblate-4.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:41.278654Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-35","description":"Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.","status":"published","published":"2022-02-25T21:15:00Z","modified":"2023-12-06T01:02:04.640923Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}