CVE-2022-23321: n/a persistent XSS

CISO Take

This is a stored cross-site scripting flaw in two input fields of the user-edit screen inside XMPie UStore's administrative panel (version 12.3.7244.0), allowing an attacker who can write to those fields to plant JavaScript that executes in the browser of any admin who later views the affected user record. XMPie UStore is a print/marketing storefront platform, not an AI/ML system — its 'ml_ui' tagging here appears to be a categorization artifact, and none of our tracked AI/ML packages are implicated. EPSS sits at 0.585%, placing it around the 56th percentile for exploitation likelihood, it is not in CISA KEV, and no public exploit code or Nuclei template exists, so real-world attacker interest looks minimal right now. Because there's no CVSS score or vendor patch reference beyond the release notes page, treat this as a low-priority hygiene item: confirm the version in use, check XMPie's release notes for a fix build past 12.3.7244.0, and in the meantime restrict admin panel access and enforce output encoding/CSP as a compensating control. This does not warrant a breaking alert or urgent action for AI/ML security teams.

Sources: NVD EPSS triaxiomsecurity.com xmpie.com

What is the risk?

Low urgency. This is a classic stored XSS requiring an attacker to already have some ability to write to user-editable fields in an administrative interface — a meaningfully restricted attack surface. No CVSS vector, no KEV listing, no public PoC/exploit, and mid-range EPSS (56th percentile) all point to low active-exploitation risk. The absence of any AI/ML package linkage means this finding has essentially no relevance to model, agent, or pipeline security — it is a conventional web application vulnerability that happens to have been swept into this feed under an 'ml_ui' tag.

How does the attack unfold?

Payload Injection

Attacker with access to the user-edit form submits a malicious script into one of the two vulnerable input fields.

Persistent Storage

The unsanitized payload is stored server-side and served back unescaped whenever the affected user record is rendered.

Victim Execution

A privileged administrator opens the poisoned user record and the script executes in their authenticated browser session.

Session Impact

The attacker leverages the executed script to hijack the admin's session or perform unauthorized actions under their identity.

Payload Injection

Attacker with access to the user-edit form submits a malicious script into one of the two vulnerable input fields.

Persistent Storage

The unsanitized payload is stored server-side and served back unescaped whenever the affected user record is rendered.

Victim Execution

A privileged administrator opens the poisoned user record and the script executes in their authenticated browser session.

Session Impact

The attacker leverages the executed script to hijack the admin's session or perform unauthorized actions under their identity.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Check XMPie's release notes (https://www.xmpie.com/ustore-release-notes/) for a build newer than 12.3.7244.0 that fixes input sanitization on the user-edit fields, and apply it. Until patched, restrict access to the administrative panel to a minimal trusted set of accounts/IPs, enforce a strict Content-Security-Policy and output-encode user-editable fields server-side, and monitor admin panel audit logs for anomalous user-edit submissions containing script tags or event handlers. No detection signature beyond generic XSS payload monitoring (<script>, onerror=, javascript:) is currently published.

How is it classified?

Code Execution Privacy Violation Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2022-23321?

This is a stored cross-site scripting flaw in two input fields of the user-edit screen inside XMPie UStore's administrative panel (version 12.3.7244.0), allowing an attacker who can write to those fields to plant JavaScript that executes in the browser of any admin who later views the affected user record. XMPie UStore is a print/marketing storefront platform, not an AI/ML system — its 'ml_ui' tagging here appears to be a categorization artifact, and none of our tracked AI/ML packages are implicated. EPSS sits at 0.585%, placing it around the 56th percentile for exploitation likelihood, it is not in CISA KEV, and no public exploit code or Nuclei template exists, so real-world attacker interest looks minimal right now. Because there's no CVSS score or vendor patch reference beyond the release notes page, treat this as a low-priority hygiene item: confirm the version in use, check XMPie's release notes for a fix build past 12.3.7244.0, and in the meantime restrict admin panel access and enforce output encoding/CSP as a compensating control. This does not warrant a breaking alert or urgent action for AI/ML security teams.

Is CVE-2022-23321 actively exploited?

No confirmed active exploitation of CVE-2022-23321 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-23321?

Check XMPie's release notes (https://www.xmpie.com/ustore-release-notes/) for a build newer than 12.3.7244.0 that fixes input sanitization on the user-edit fields, and apply it. Until patched, restrict access to the administrative panel to a minimal trusted set of accounts/IPs, enforce a strict Content-Security-Policy and output-encode user-editable fields server-side, and monitor admin panel audit logs for anomalous user-edit submissions containing script tags or event handlers. No detection signature beyond generic XSS payload monitoring (`<script>`, `onerror=`, `javascript:`) is currently published.

What is the CVSS score for CVE-2022-23321?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.

Exploitation Scenario

An attacker with limited access to the UStore admin panel (or an account with permission to edit user records) inserts a JavaScript payload into one of the two vulnerable input fields on the user-edit form. The payload is stored persistently in the backend. When a higher-privileged administrator later opens that user's profile to review or edit it, the script executes in their authenticated browser session, potentially exfiltrating session cookies or performing unauthorized admin actions on the attacker's behalf.