PT-2022-24411 · Phpipam+1 · Phpipam+1

Published 2016-12-29 · Updated 2023-05-20 · CVE-2022-3845

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpipam versions prior to 1.5.0

Description A vulnerability has been found in phpipam, allowing for cross site scripting through the manipulation of an unknown functionality in the file app/admin/import-export/import-load-data.php of the Import Preview Handler component. The attack can be launched remotely.

Recommendations For versions prior to 1.5.0, upgrade to version 1.5.0 to address this issue.

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

ALT-PU-2016-2512

ALT-PU-2023-1837

CVE-2022-3845

Affected Products

Alt Linux

Phpipam

References · 5

• https://github.com/phpipam/phpipam/commit/22c797c3583001211fe7d31bccd3f1d4aeeb3bbc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3845 · Vendor Advisory
• https://github.com/phpipam/phpipam/releases/tag/v1.5.0 · Note
• https://vuldb.com/?id.212863 · Note