PT-2022-18319 · National Instruments · G Web Development+4

Published 2022-04-21 · Updated 2022-05-03 · CVE-2022-27237

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SystemLink versions prior to 2021 R3 FlexLogger versions prior to 2022 Q2 LabVIEW versions prior to 2021 SP1 G Web Development versions prior to 2022 R1 Static Test Software Suite versions prior to 1.2

Description There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products.

Recommendations For SystemLink versions prior to 2021 R3, install SystemLink version 2021 R3 or later. For FlexLogger versions prior to 2022 Q2, install FlexLogger 2022 Q2 or later. For LabVIEW versions prior to 2021 SP1, install LabVIEW 2021 SP1. For G Web Development versions prior to 2022 R1, install G Web Development 2022 R1 or later. For Static Test Software Suite versions prior to 1.2, install Static Test Software Suite version 1.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27237

Affected Products

Flexlogger

G Web Development

Labview

Static Test Software Suite

Systemlink

References · 5

• https://ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27237 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27237 · Vendor Advisory
• https://t.me/cvenotify/29268 · Telegram Post
• https://t.me/cibsecurity/41217 · Telegram Post