Lucene search

[email protected]CVE-2022-27237

HistoryApr 21, 2022 - 5:15 a.m.

CVE-2022-27237

2022-04-2105:15:06

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-27237

cross-site scripting

xss

ni web server

systemlink

flexlogger

labview

g web development

static test software suite

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.4%

JSON

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

Affected configurations

NVD

Node

niflexloggerMatch2021r2

niflexloggerMatch2021r3

niflexloggerMatch2021r4

nig_web_development_softwareMatch2021-

nig_web_development_softwareMatch2021community

nilabviewMatch2021--

nilabviewMatch2021-community

nistatic_test_software_suiteRange<1.2

nisystemlinkMatch2020r4

nisystemlinkMatch2022r1

nisystemlinkMatch2022r2

CPENameOperatorVersion
ni:flexloggerni flexloggereq2021
ni:g_web_development_softwareni g web development softwareeq2021
ni:labviewni labvieweq2021
ni:static_test_software_suiteni static test software suitelt1.2
ni:systemlinkni systemlinkeq2020
ni:systemlinkni systemlinkeq2022

CPE	Name	Operator	Version
ni:flexlogger	ni flexlogger	eq	2021
ni:g_web_development_software	ni g web development software	eq	2021
ni:labview	ni labview	eq	2021
ni:static_test_software_suite	ni static test software suite	lt	1.2
ni:systemlink	ni systemlink	eq	2020
ni:systemlink	ni systemlink	eq	2022

References

www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.4%

JSON

Related for CVE-2022-27237

prion1 cvelist1 nvd1