Lucene search

MitreCVE-2022-39813

HistoryJan 27, 2023 - 10:15 p.m.

CVE-2022-39813

2023-01-2722:15:08

CWE-79

mitre

web.nvd.nist.gov

italtel

netmatch-s

5.2.0-20211008

multiple reflected

stored xss

nmsciwebgui

j_security_check

j_username

actloglineview.jsp

actline

javascript

vulnerability

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary JavaScript. The payload would then be triggered every time an authenticated user browses the page containing it.

Affected configurations

Nvd

Node

italtelnetmatch-s_ciMatch5.2.0-20211008

VendorProductVersionCPE
italtelnetmatch-s_ci5.2.0-20211008cpe:2.3:a:italtel:netmatch-s_ci:5.2.0-20211008:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
italtel	netmatch-s_ci	5.2.0-20211008	cpe:2.3:a:italtel:netmatch-s_ci:5.2.0-20211008:::::::*

References

www.gruppotim.it/it/footer/red-team.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Related for CVE-2022-39813