CVE-2022-23165

🗓️ 12 May 2022 19:49:18Reported by INCDType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 67 Views🌐 WEB

Sysaid 14.2.0 XSS vulnerability in "/help/treecontent.jsp

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2022-23165	9 May 202211:39	–	attackerkb
Circl	CVE-2022-23165	13 May 202200:42	–	circl
CNNVD	Sysaid Technologies Sysaid 跨站脚本漏洞	12 May 202200:00	–	cnnvd
Cvelist	CVE-2022-23165 Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)	12 May 202219:49	–	cvelist
EUVD	EUVD-2022-28256	3 Oct 202520:07	–	euvd
NVD	CVE-2022-23165	12 May 202220:15	–	nvd
Prion	Cross site scripting	12 May 202220:15	–	prion

NVD

Node

sysaid sysaidRange<22.1.64on-premises

sysaid sysaidRange<22.2.20cloud

[
  {
    "platforms": [
      "cloud"
    ],
    "product": "Sysaid",
    "vendor": "SysAid",
    "versions": [
      {
        "lessThanOrEqual": "22.2.19",
        "status": "affected",
        "version": "22.2.19 cloud version",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "on premise"
    ],
    "product": "Sysaid",
    "vendor": "SysAid",
    "versions": [
      {
        "lessThanOrEqual": "22.1.63",
        "status": "affected",
        "version": "22.1.63 on premise version",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gov	www.gov.il/en/departments/faq/cve_advisories

Parameter	Position	Path	Description	CWE
helpPageName	query param	/help/treecontent.jsp	Reflected XSS in helpPageName parameter on /help/treecontent.jsp when Offline Help Pages are exposed; attacker can execute client-side code or gain sensitive information via phishing.	CWE-79

21 Nov 2024 06:48Current

5.9Medium risk

Vulners AI Score5.9

CVSS 24.3

CVSS 3.15.5 - 6.1

EPSS0.00146

CWE-79