PT-2022-24065 · Genesys · Genesys Pureconnect Interaction Web Tools Chat Service

Jake Murphy · Published 2022-09-16 · Updated 2022-09-20 · CVE-2022-37775

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Genesys PureConnect Interaction Web Tools Chat Service versions prior to at least 26-September-2019

Description The issue allows XSS within the Printable Chat History via the participant -> name JSON POST parameter. This enables potential attackers to inject malicious scripts into the chat history, which could lead to unauthorized actions or data exposure.

Recommendations For Genesys PureConnect Interaction Web Tools Chat Service versions prior to at least 26-September-2019, as a temporary workaround, consider restricting access to the Printable Chat History feature until a patch is available. Additionally, avoid using the participant -> name JSON POST parameter in the affected service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37775

Affected Products

Genesys Pureconnect Interaction Web Tools Chat Service

References · 9

• 🔥 http://packetstormsecurity.com/files/168410/Genesys-PureConnect-Cross-Site-Scripting.html · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2022090038 · Exploit
• https://osv.dev/vulnerability/CVE-2022-37775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37775 · Security Note
• https://help.genesys.com/pureconnect/mergedprojects/wh_tr/desktop/pdfs/web_tools_dg.pdf · Vendor Advisory
• http://genesys.com · Note
• https://t.me/cvenotify/36450 · Telegram Post
• https://t.me/cvenotify/36360 · Telegram Post
• https://t.me/cibsecurity/49934 · Telegram Post