PT-2023-12955 · Nokia · Nokia Netact

Andrea Carlo Maria Dattola + 2 · Publicado 2023-07-24 · Atualizado 2023-08-02 · CVE-2022-28865

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia NetAct version 22

Description An issue was discovered in the Site Configuration Tool website section, where a malicious user can change the filename of an uploaded file to include JavaScript code. This code is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. The API endpoint "/netact/sct" with the filename parameter is used for this purpose.

Recommendations For Nokia NetAct version 22, consider disabling the ability to upload files through the Site Configuration Tool website section until a patch is available. Restrict access to the "/netact/sct" API endpoint to minimize the risk of exploitation. Avoid using the filename parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-28865

Produtos afetados

Nokia Netact

Referências · 6

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://t.me/cibsecurity/67150 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-28865 · Nota de Segurança
• https://telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html · Nota
• https://osv.dev/vulnerability/CVE-2022-28865 · Aviso do Fabricante
• https://t.me/cvenotify/55040 · Publicação no Telegram