CVE-2022-50802
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.1 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability Description
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-79
Source
NVD
Vendor
etaplighting
Product
etap_safety_manager
External References
- https://cxsecurity.com/issue/WLB-2022090031
- https://exchange.xforce.ibmcloud.com/vulnerabilities/235743
- https://packetstormsecurity.com/files/168339/
- https://www.etaplighting.com/
- https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
- https://cxsecurity.com/issue/WLB-2022090031
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
Discussion (0)
Add Comment
No comments yet. Be the first!