CVE-2022-30278

The cross-site scripting here doesn't live in Black Duck Hub's own application logic but in the MadCap Flare documentation framework embedded in its help system: improper validation of user-supplied input to that embedded help lets an unauthenticated remote attacker land script by getting a user to click a crafted link. When the victim follows it, the payload executes in their browser session and can reach sensitive browser-based information tied to the Hub interface.

Reflected XSS is interaction-gated by nature — the attacker has to craft a malicious link and convince a target to click it, so this is a phishing-shaped vector, not a self-firing or mass-exploited one. The value is scoped to what an attacker can do inside the victim's authenticated browser context: session-riding, reading interface data, or pivoting UI actions. That it's parked in bundled help documentation rather than a core function also means it's a peripheral surface, which together with the click requirement keeps it firmly at medium.

Our angle is proportionate ranking plus web-layer detection. We'd note that the flaw is in an embedded third-party doc framework, treat it as a patch-on-cadence item on Black Duck Hub's line, and rank it below anything unauthenticated-and-automatic. Where we have web filtering or proxy logging in front of the Hub, we'd watch for the reflected-XSS request pattern hitting the help documentation paths, and reinforce the usual message that suspicious links into internal tools shouldn't be clicked — since user interaction is the only way this fires.