CVE-2022-36783

Опубликовано: 25 окт. 2022

Источник: nvd

CVSS3: 6.5

CVSS3: 5.4

EPSS Низкий

Описание

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.

Ссылки

https://www.gov.il/en/Departments/faq/cve_advisories
Third Party Advisory
https://www.gov.il/en/Departments/faq/cve_advisories
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:algosec:fireflow:*:*:*:*:*:*:*:*

Версия от a32.0 (включая) до a32.0.580-277 (исключая)

cpe:2.3:a:algosec:fireflow:*:*:*:*:*:*:*:*

Версия от a32.10 (включая) до a32.10.410-212 (исключая)

cpe:2.3:a:algosec:fireflow:*:*:*:*:*:*:*:*

Версия от a32.20 (включая) до a32.20.230-35 (исключая)

EPSS

Процентиль: 38%

0.00168

Низкий

6.5 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-jpmh-qrhq-g32f

CVSS3: 5.4

github

больше 3 лет назад

AlgoSec FireFlow Reflected Cross-Site-Scripting (RXSS): A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.

EPSS

Процентиль: 38%

0.00168

Низкий

6.5 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79