Positive TechnologiesPT-2022-05PT-2022-05: Stored Cross-Site Scripting (XSS)
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
40.5%
PT-2022-05: Stored Cross-Site Scripting (XSS)
Nokia
Vulnerable software
NetAct v 20.1
Severity level
Severity level: Medium
Impact: Stored Cross-Site Scripting (XSS)
Access Vector: Remote
CVSS v3.1
Base Score: 5,0
Vector: (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/MAV:L/MAC:H/MPR:L/MUI:R/MS:C/MC:L/MI:L/MA:L)
CVE-2023-26061
Vulnerability description:
Input validation was missing while creating the schedule task in alarm reports dashboard. An attacker can create a script to inject XSS. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards.
Advisory status
10.10.2022 - Vendor gets vulnerability details
Credits
The vulnerability was detected by Vladimir Razov and Aleksandr Ustinov (Positive Technologies)
Related
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
40.5%