CVE-2022-48197
Publication date 2 January 2023
Last updated 11 February 2026
Ubuntu priority
Description
Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| maas | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Ignored end of standard support | |
| yui | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Ignored end of standard support | |
| yui3 | ||
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Ignored end of standard support |
Notes
jdstrand
maas uses an embedded copy of yui 3.4.1 in 12.04 and portions of yui3 in 12.10 and higher
mdeslaur
yui3 doesn't contain the treeview directory, so it doesn't appear vulnerable to this issue
john-breton
As mentioned in the description, upstream has archived the project, and there was analysis done to demonstrate this only affects the Sandbox, which we don't include in our YUI artifacts. As such this cannot be exploited in Ubuntu.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.1 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |