PT-2022-20714 · Proxmox · Proxmox Virtual Environment

Cursered + 1 · Published 2022-12-14 · Updated 2024-10-29 · CVE-2022-31358

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment versions prior to 7.2-3

Description A reflected cross-site scripting (XSS) issue allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under the path "/api2/html/". This enables attackers to potentially manipulate web content.

Recommendations For versions prior to 7.2-3, update to version 7.2-3 or later to resolve the issue. As a temporary workaround, consider restricting access to non-existent endpoints under the "/api2/html/" path to minimize the risk of exploitation.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31358

Affected Products

Proxmox Virtual Environment

References · 8

• 🔥 https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31358 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31358 · Vendor Advisory
• https://t.me/cvenotify/39845 · Telegram Post
• https://t.me/cibsecurity/54515 · Telegram Post
• https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=00661f1223b7c0afffa64e1d91f5e018b985f762 · Note
• https://proxmox.com/en · Note
• http://proxmox.com · Note