Security readout for executives and security teams
Plain-English summary
A flaw in sproctor php-calendar can let an attacker inject script through the calendar page path handling. The likely business impact is user-session or content manipulation in affected calendar deployments, not direct server takeover based on the provided sources.
Executive priority
Treat this as a moderate web application risk. Prioritize patching if php-calendar is internet-facing, handles authenticated users, or is embedded in a trusted internal portal. It is not reported as actively exploited in the provided sources.
Technical view
CVE-2022-4455 affects sproctor php-calendar 2.0.0 through 2.0.13. The issue is reported in index.php, where manipulation of $_SERVER['PHP_SELF'] can cause cross-site scripting. CVSS 4.0 scores it 5.1 with network access, low attack complexity, low privileges, passive user interaction, and limited integrity impact.
Likely exposure
Exposure is limited to organizations running sproctor php-calendar versions 2.0.0 through 2.0.13, especially if reachable by users or the internet. The source bundle provides no CPEs, deployment prevalence, or configuration-specific exposure details.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. VulDB states the attack may be launched remotely, while the CVSS vector indicates low privileges and passive user interaction are required. No exploit steps are provided here.
Researcher notes
The record identifies XSS through $_SERVER['PHP_SELF'] in index.php and names a specific patch commit. Evidence is incomplete on exploit maturity, real-world abuse, and exact vulnerable code paths beyond the cited file and parameter source.
Mitigation direction
- Apply upstream patch commit a2941109b42201c19733127ced763e270a357809.
- Confirm all php-calendar deployments are newer than 2.0.13 or patched.
- Restrict access to legacy calendar instances until patched.
- Review vendor or maintainer guidance for any additional remediation notes.
Validation and detection
- Inventory servers and repositories for sproctor php-calendar usage.
- Check installed versions against 2.0.0 through 2.0.13.
- Confirm index.php includes the upstream patch changes.
- Review web logs for suspicious requests to affected calendar routes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4455 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
Source materials
- CVE List V5 sourceCVE List V5
- VDB-215445 | sproctor php-calendar index.php cross site scriptingCVE reference · vdb-entry, technical-description
- VDB-215445 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.