Lucene search

Rapid7CVE-2022-35632

HistoryJul 29, 2022 - 5:15 p.m.

CVE-2022-35632

2022-07-2917:15:09

CWE-79

rapid7

web.nvd.nist.gov

velociraptor

gui

editor

xss

vql

function

description

vulnerability

security

nvd

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.7%

JSON

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.

Affected configurations

Nvd

Node

rapid7velociraptorRange<0.6.5-2

VendorProductVersionCPE
rapid7velociraptor*cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rapid7	velociraptor	*	cpe:2.3:a:rapid7:velociraptor::::::::

CNA Affected

[
  {
    "product": "Velociraptor",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "0.6.5-2",
        "status": "affected",
        "version": "0.6.5-2",
        "versionType": "custom"
      }
    ]
  }
]

References

www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/

Social References