PT-2022-17160 · Unknown · Money Transfer Management System

Oscar Uribe · Published 2022-03-23 · Updated 2022-03-29 · CVE-2022-25221

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Money Transfer Management System version 1.0

Description The issue allows an attacker to inject JavaScript code in the URL, which can then be used to trick a user into visiting the link and executing the JavaScript code.

Recommendations For Money Transfer Management System version 1.0, consider disabling JavaScript execution in URLs as a temporary workaround until a patch is available. Restrict access to URLs that may contain malicious JavaScript code to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-25221

Affected Products

Money Transfer Management System

References · 3

• 🔥 https://fluidattacks.com/advisories/charles · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25221 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25221 · Vendor Advisory