PT-2022-27637 · Sens · Sens

Published 2022-12-12 · Updated 2022-12-12 · CVE-2022-45758

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SENS version 1.0

Description The issue is related to Cross Site Scripting (XSS) via the com.liuyanzhao.sens.web.controller.admin controller, specifically the getRegister function. This allows for potential malicious script execution.

Recommendations For SENS version 1.0, as a temporary workaround, consider disabling the getRegister function in the com.liuyanzhao.sens.web.controller.admin controller until a patch is available. Restrict access to this controller to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45758

Affected Products

Sens

References · 3

• 🔥 https://github.com/saysky/SENS/issues/19 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45758 · Security Note
• https://t.me/cvenotify/39677 · Telegram Post