CVE-2022-43712

GX Software XperienCentral 10.36.0 and earlier is affected by CVE-2022-22965 (Spring4Shell) via data binding in Spring MVC/WebFlux on Java 9+. An attacker able to reach a vulnerable WAR/deployed app could achieve remote code execution. Root cause: unsafe data binding in Spring Framework modules; ...

CVE-2022-43713

GX Software XperienCentral has an IAF validation bypass vulnerability (CVE-2022-43713) affecting versions 10.33.1 through 10.35.0, allowing invalid data input via Interactive Forms. The issue stems from bypassable form validation in IAF. Impact is mainly data integrity for inputs; CVSS indicates ...

CVE-2022-43710

CVE-2022-43710 affects GX Software XperienCentral, versions 10.31.0 through 10.33.0. The vulnerability is a cross-site request forgery (CSRF) where the unique token can be deduced from the names of all input fields. The impact is CSRF exploitation risk as described in multiple sources. No exploit...

CVE-2022-43711

GX Software XperienCentral (versions 10.29.1–10.33.0) is affected by a cross-site scripting (XSS) vulnerability caused by the CSP header using eval() in the script-src directive. The issue is tied to Interactive Forms (IAF) functionality and can be triggered via user interaction with the affected...