Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-47373
HistoryFeb 15, 2023 - 12:00 a.m.

CVE-2022-47373

2023-02-1500:00:00
ubuntu.com
ubuntu.com
12
cross site scripting
search functionality
module library
forget password
input validation
sanitization
javascript payload
unix

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

0.0005 Low

EPSS

Percentile

16.4%

Reflected Cross Site Scripting in Search Functionality of Module Library in
Pandora FMS Console v766 and lower. This vulnerability arises on the forget
password functionality in which parameter username does not proper input
validation/sanitization thus results in executing malicious JavaScript
payload.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpandora< anyUNKNOWN
ubuntu16.04noarchpandora< anyUNKNOWN

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

0.0005 Low

EPSS

Percentile

16.4%

Related for UB:CVE-2022-47373