PT-2022-16761 · Unknown · Eyesofnetwork

Arianeblow · Published 2022-02-25 · Updated 2022-03-04 · CVE-2022-24612

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3.11

Description An authenticated user can upload an XML file containing an XSS via the ITSM module, resulting in a stored XSS.

Recommendations For EyesOfNetwork version 5.3.11, consider disabling the XML file upload feature in the ITSM module until a patch is available. Restrict access to the ITSM module to minimize the risk of exploitation. Avoid using the XML file upload feature in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24612

Affected Products

Eyesofnetwork

References · 5

• 🔥 https://github.com/EyesOfNetworkCommunity/eonweb/issues/114 · Exploit
• https://osv.dev/vulnerability/CVE-2022-24612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24612 · Security Note
• https://t.me/cibsecurity/38082 · Telegram Post
• https://t.me/cvenotify/27728 · Telegram Post