By combining AI with human insight, Armis Vulnerability Intelligence Database offers extended coverage for vulnerabilities that matter to you, your industry, and provides you with clear remediation instructions.
Loading CVE list…
CVE Name
Severity Score
Published Date
CISA KEV
Take These Insights to the Next Level
Armis now offers direct API access to Armis Vulnerability Intelligence Database through the AWS Marketplace, transforming it from a powerful research tool into an integrated component of your proactive security posture.
Seamless Integration: Directly feed Armis's contextual data into your existing stack.
Automated Workflows: Automate vulnerability lookups in real-time.
Custom Solutions: Use the raw data to build custom dashboards, reports, alerts.
See everything.Identify true risk.Proactively mitigate threats.Book a Demo
Let's talk!
CVE-2022-1503:
Loading CVE details…
CVE-2022-1503 | Medium Severity | Armis
) can lead to JavaScript execution within the context of an authenticated admin session. Exploitation may be possible over the network but requires valid authentication, and the advisory provides exploit details. The vulnerability is rated CVSSv3.1 base score 3.5 (low), indicating low to moderate impact primarily through credentialed user context.\n","datePublished":"2022-04-27T08:15:37.000Z","dateModified":"2026-05-13T09:04:24.036Z","keywords":"Medium, 2022, CVE, vulnerability, cybersecurity, CVSS","url":"https://cve.armis.com/CVE-2022-1503","author":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"publisher":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"license":"https://creativecommons.org/licenses/by-nc-sa/4.0/","isBasedOn":{"@type":"WebPage","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1503","name":"NVD CVE-2022-1503"},"additionalProperty":[{"@type":"PropertyValue","name":"CVSS Score","value":"5.4"},{"@type":"PropertyValue","name":"Severity","value":"Medium"},{"@type":"PropertyValue","name":"EPSS Score","value":"0.18%"},{"@type":"PropertyValue","name":"EPSS Percentile","value":"40th"},{"@type":"PropertyValue","name":"Attack Vector","value":"NETWORK"},{"@type":"PropertyValue","name":"Attack Complexity","value":"LOW"},{"@type":"PropertyValue","name":"Privileges Required","value":"LOW"},{"@type":"PropertyValue","name":"User Interaction","value":"REQUIRED"},{"@type":"PropertyValue","name":"Scope","value":"CHANGED"},{"@type":"PropertyValue","name":"Confidentiality Impact","value":"LOW"},{"@type":"PropertyValue","name":"Integrity Impact","value":"LOW"},{"@type":"PropertyValue","name":"Availability Impact","value":"NONE"}]},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2022-1503?","acceptedAnswer":{"@type":"Answer","text":"A cross-site scripting vulnerability in GetSimple CMS Content Module edit.php allows injection via the post-content parameter. The attack may be launched remotely but requires authentication.\n"}},{"@type":"Question","name":"How severe is CVE-2022-1503?","acceptedAnswer":{"@type":"Answer","text":"CVE-2022-1503 has a CVSS score of 5.4 (Medium severity). EPSS score: 0.18% (40th percentile), indicating the estimated probability of exploitation in the wild."}},{"@type":"Question","name":"How do I fix CVE-2022-1503?","acceptedAnswer":{"@type":"Answer","text":"- Update GetSimple CMS to the latest available release that includes the fix for this vulnerability.\n- If a patched release is not available, implement input validation and output encoding for the post-content field in /admin/edit.php. Sanitize or escape user-supplied content and apply a safe HTML allowlist.\n- Ensure server-side escaping when rendering post-content (e.g., encode HTML entities) to prevent script execution.\n- Implement a Content Security Policy (CSP) that disallows inline scripts and restricts script sources.\n- Strengthen admin access controls: enforce strong authentication, consider multi-factor authentication, and restrict admin access by IP where feasible.\n- Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads against the Content Module.\n- Test the fix in a staging environment with multiple XSS payloads and verify that scripts no longer execute; monitor logs for related activity.\n- If feasible, disable or harden the post-content editing feature in environments where it is not required.\n"}}]},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://cve.armis.com/"},{"@type":"ListItem","position":2,"name":"CVE-2022-1503","item":"https://cve.armis.com/CVE-2022-1503"}]}]
CVE-2022-1503:
A cross-site scripting vulnerability in GetSimple CMS Content Module edit.php allows injection via the post-content parameter. The attack may be launched remotely but requires authentication.
Score
A numerical rating that indicates how dangerous this vulnerability is.
5.4Medium
Published Date:Apr 27, 2022
CISA KEV Date:*No Data*
Industries Affected:20
Threat Predictions
EPSS Score:0.2
EPSS Percentile:40%
Exploitability
Score:2.3
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:REQUIRED
Scope:CHANGED
Impact
Score:2.7
Confidentiality Impact:LOW
Integrity Impact:LOW
Availability Impact:NONE
Description Preview
A cross-site scripting vulnerability in GetSimple CMS Content Module edit.php allows injection via the post-content parameter. The attack may be launched remotely but requires authentication.
Overview
GetSimple CMS's Content Module contains a cross-site scripting vulnerability in the admin edit functionality. Crafting the post-content input (for example, using alert(1)) can lead to JavaScript execution within the context of an authenticated admin session. Exploitation may be possible over the network but requires valid authentication, and the advisory provides exploit details. The vulnerability is rated CVSSv3.1 base score 3.5 (low), indicating low to moderate impact primarily through credentialed user context.
Remediation
Update GetSimple CMS to the latest available release that includes the fix for this vulnerability.
If a patched release is not available, implement input validation and output encoding for the post-content field in /admin/edit.php. Sanitize or escape user-supplied content and apply a safe HTML allowlist.
Ensure server-side escaping when rendering post-content (e.g., encode HTML entities) to prevent script execution.
Implement a Content Security Policy (CSP) that disallows inline scripts and restricts script sources.
Strengthen admin access controls: enforce strong authentication, consider multi-factor authentication, and restrict admin access by IP where feasible.
Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads against the Content Module.
Test the fix in a staging environment with multiple XSS payloads and verify that scripts no longer execute; monitor logs for related activity.
If feasible, disable or harden the post-content editing feature in environments where it is not required.
