Traffic Manager
CVE-2022-42460
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
AnalysisAI
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. Affected products include: Sedlex Traffic Manager.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Traffic Manager
View allAuthenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6
Missing Authorization vulnerability in SedLex Traffic Manager.4.5. Rated medium severity (CVSS 5.4), this vulnerability
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST AP
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to i
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the Graal
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded conte
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML par
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAp
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input valida
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper valida
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today