Read the docs
TI-2022-07598 Aliases CVE-2022-23543

HTML attributes when attaching a YouTube link to the post

Priority LOW 28CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert("xss")`) to the `<iframe>'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix Fixed silverwaregames-io-issue-tracker (mesosoi): 1.1.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mesosoisilverwaregames-io-issue-trackerbefore 1.1.341.1.34Patch availableCNA
  • silverwaregames-io-issue-tracker Vendormesosoi Affected before 1.1.34 Fixed in 1.1.34 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:*before 1.1.34Vulnerablemesosoi
  • cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:* Versions before 1.1.34 Vulnerable ·mesosoi

Remediation

  • Fix · CNA silverwaregames-io-issue-tracker (mesosoi) Fixed in 1.1.34

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23543

References

Advisory 1

  • TI-2023-21052 Silverware Games vulnerable to account enumeration via inconsistent responses CVSS 3.1MEDIUM 5.3
  • TI-2022-16495 SilverwareGames.io used == for hashing instead of === CVSS 3.1MEDIUM 5.9
  • TI-2023-21055 silverware-io-issue-tracker server responds in a noticeably different amount of time… CVSS 3.1MEDIUM 5.3
  • TI-2023-13620 Exposure of resource to wrong sphere in mesosoi silverwaregames-io-issue-tracker CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences