CVE-2022-29648: 
Java vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Jfinal CMS version 5.1.0. The vulnerability (CVE-2022-29648) allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request header (NVD, MITRE). The vulnerability was discovered and reported on April 14, 2022.

The vulnerability exists in the guest TOP10 feature of Jfinal CMS where user IP addresses are displayed. The application does not properly sanitize the X-Forwarded-For header value before storing and displaying it, allowing attackers to inject malicious XSS payloads. When an administrator logs into the system, the stored malicious code is executed (GitHub Issue).

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of an administrator's browser session. This could potentially lead to account compromise, data theft, or unauthorized administrative actions when an administrator views the affected pages (GitHub Issue).

Security recommendations include implementing strict input filtering for user-supplied data and controlling page rendering content to prevent XSS attacks. Organizations should also consider upgrading to a patched version if available (GitHub Issue).