CVE-2022-35632 XSS in User Interface

2022-07-2600:00:00

CWE-79

rapid7

www.cve.org

velociraptor

xss

vulnerability

gui

patched

version 0.6.5-2

0.001 Low

EPSS

Percentile

22.7%

JSON

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.

CNA Affected

[
  {
    "product": "Velociraptor",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "0.6.5-2",
        "status": "affected",
        "version": "0.6.5-2",
        "versionType": "custom"
      }
    ]
  }
]