PT-2022-23762 · Isams · Isams

Mathieu Vivier · Published 2022-09-27 · Updated 2022-09-30 · CVE-2022-37028

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ISAMS version 22.2.3.2

Description The issue allows an attacker to perform a stored Cross-site Scripting (XSS) attack by injecting a JavaScript payload into the title field for groups. This payload will be executed when another user uses the application.

Recommendations For ISAMS version 22.2.3.2, as a temporary workaround, consider restricting access to the title field for groups to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37028

Affected Products

Isams

References · 5

• https://osv.dev/vulnerability/CVE-2022-37028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37028 · Security Note
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-37028 · Note
• https://isams.com · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-37028 · Note