PT-2022-17014 · Dhc · Dhc Vision Eqms

Domenik Jockers · Published 2022-03-29 · Updated 2022-04-04 · CVE-2022-24957

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DHC Vision eQMS versions 5.4.8.322 and earlier

Description The issue is related to insufficient encoding of untrusted input/output, leading to Persistent XSS. To exploit this, an attacker must create or edit a new information object, using the XSS payload as the name. Any user who opens the object's version or history tab will be attacked.

Recommendations For versions 5.4.8.322 and earlier, as a temporary workaround, consider restricting the ability to create or edit information objects to prevent the introduction of XSS payloads. Additionally, limit access to the version and history tabs of information objects until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24957

Affected Products

Dhc Vision Eqms

References · 5

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-019.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-24957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24957 · Security Note
• https://syss.de · Note
• https://t.me/cibsecurity/39715 · Telegram Post