Vulnerability CVE-2022-36783

Vulnerability Name:

CVE-2022-36783

Assigned:

2022-10-25

Published:

2022-10-25

Updated:

2022-10-27

Summary:

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

References:

Source: MITRE
Type: CNA
CVE-2022-36783

Source: MISC
Type: Third Party Advisory
https://www.gov.il/en/Departments/faq/cve_advisories

Vulnerable Configuration:

Configuration 1:

cpe:/a:algosec:fireflow:*:*:*:*:*:*:*:* (Version >= a32.0 and < a32.0.580-277)

OR cpe:/a:algosec:fireflow:*:*:*:*:*:*:*:* (Version >= a32.10 and < a32.10.410-212)

OR cpe:/a:algosec:fireflow:*:*:*:*:*:*:*:* (Version >= a32.20 and < a32.20.230-35)

Denotes that component is vulnerable

BACK