Lucene search

ProfelisCVELIST:CVE-2022-25620

HistoryMar 30, 2022 - 2:55 p.m.

CVE-2022-25620 Stored Cross-Site Scripting (XSS)

2022-03-3014:55:11

CWE-80

Profelis

www.cve.org

cve-2022-25620

stored cross-site scripting

profelis it consultancy sambabox

vulnerability

authenticated user

arbitrary code

web page

CVSS3

3.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.

CNA Affected

[
  {
    "platforms": [
      "x86"
    ],
    "product": "SambaBox",
    "vendor": "Profelis IT Consultancy",
    "versions": [
      {
        "lessThanOrEqual": "4.0",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.sambabox.io/sambabox-surum-4-0/

CVSS3

3.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVELIST:CVE-2022-25620