{"id":"CVE-2022-30278","aliases":["EUVD-2022-52233","GHSA-rrp3-4pgp-rgch"],"status":"published","title":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an...","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00828,"percentile":0.5777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-05-10T19:47:30Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"synopsys","product":"black duck hub"},{"vendor":"synopsys","product":"black_duck_hub"}],"references":[{"url":"https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30278","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rrp3-4pgp-rgch"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30278.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-30278","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","status":"published","published":"2022-05-10T19:47:30Z","modified":"2024-08-03T06:48:34.884Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:31.184134Z"}],"euvd":[{"id":"EUVD-2022-52233","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","status":"published","published":"2022-05-10T19:47:30Z","modified":"2024-08-03T06:48:34Z","updated_at":"2026-11-03T03:25:36.95433Z"}],"ghsa":[{"id":"GHSA-rrp3-4pgp-rgch","title":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an...","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","status":"published","published":"2022-05-11T00:01:08Z","modified":"2023-02-01T05:02:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:49:51.819251Z"}],"nvd":[{"id":"CVE-2022-30278","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","status":"published","published":"2022-05-10T20:15:09.827Z","modified":"2026-06-17T04:43:24.07Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:19.51203Z"}],"osv":[{"id":"CVE-2022-30278","description":"A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.","status":"published","published":"2022-05-10T19:47:30Z","modified":"2026-10-28T02:30:58.188872078Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:25.516981Z"}]}}