CVE-2022-2290

published 2022-07-03

CVE-2022-2290: Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.

Priority P1 80 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

ITW EXPLOIT VulnCheck KEV

Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
triliumnotes	trilium	< 0.52.4	0.52.4
zadam	zadam_trilium	>= unspecified < 0.53.1-beta	0.53.1-beta

Detection & IOCs extracted from sources · hover to see the quote

sigma

detection:
  condition: or
  selection_body:
    - type: word
      part: body
      words:
        - "Note '' not found"
  selection_header:
    - type: word
      part: header
      words:
        - "text/html"
  selection_status:
    - type: status
      status:
        - 404

• → Detect exploitation attempts by looking for HTTP 404 responses from Trilium containing the reflected string "Note '' not found" in the HTML body, which indicates unsanitized note-ID input is being reflected back to the user.
• → Vulnerable versions are Trilium (zadam/trilium) prior to 0.52.4 and prior to 0.53.1-beta. Presence of these versions in the environment should be treated as unpatched for this reflected XSS. ↗

• · The Nuclei-style detection template targets a 404 response with 'text/html' content-type and the body string "Note '' not found". This fingerprint may produce false positives on any legitimate missing-note navigation and should be tuned with additional XSS payload context in the URL/query parameter.

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 6.4 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

vulncheck 6.1 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79