{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.0","last_affected":"7.3"}],"component":"wonder:wonder","cve_ids":["CVE-2022-37724"],"ecosystem":"Maven","epss":0.00668,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xv7r-9vq4-9wrq","id":"tcs_01M5N9JZNSPGHV648JTVG8QHTQ","modified_at":"2023-11-08T04:10:09.606916Z","published_at":"2022-09-15T00:00:17Z","references":["https://osv.dev/vulnerability/GHSA-xv7r-9vq4-9wrq","https://nvd.nist.gov/vuln/detail/CVE-2022-37724","https://github.com/wocommunity/wonder/pull/992","https://github.com/wocommunity/wonder/commit/b0d2d74f13203268ea254b02552600850f28014b","https://github.com/wocommunity/wonder","https://xmit.xyz/security/webobjects-url-tomfoolery"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-xv7r-9vq4-9wrq","url":"https://osv.dev/vulnerability/GHSA-xv7r-9vq4-9wrq"}],"summary":"Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting"}