PT-2022-18155 · Barco · Barco Control Room Management Suite

Published 2022-06-01 · Updated 2022-06-09 · CVE-2022-26977

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Barco Control Room Management Suite web application versions prior to 3.14

Description The issue is related to the exposure of a license file upload mechanism in the web application, which lacks input sanitization. This leads to stored XSS.

Recommendations For versions prior to 3.14, consider disabling the license file upload mechanism until a patch is available. Restrict access to the upload feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26977

Affected Products

Barco Control Room Management Suite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-26977 · Security Note
• https://barco.com/en/support/transform-n-management-server · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26977 · Vendor Advisory
• https://barco.com/en/support/knowledge-base/KB12683 · Vendor Advisory
• https://t.me/cibsecurity/43660 · Telegram Post