PT-2022-4411 · Bpc · Bpc Smartvista

Tf1T + 1 · Published 2022-07-07 · Updated 2022-08-22 · CVE-2022-35554

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions BPC SmartVista version 3.28.0

Description The issue concerns reflected XSS vulnerabilities in error message handling, allowing an attacker to execute JavaScript code on the client side. Additionally, there is a vulnerability in the SmartVista CardGen personalization module due to inadequate protection of the web page structure, which can be exploited for cross-site scripting (XSS) attacks.

Recommendations For BPC SmartVista version 3.28.0, consider disabling the error message handling feature until a patch is available to prevent exploitation of the reflected XSS vulnerability. Restrict access to the SmartVista CardGen personalization module to minimize the risk of XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-05275

CVE-2022-35554

Affected Products

Bpc Smartvista

References · 7

• 🔥 https://tf1t.gitbook.io/mycve/smartvista/smartvista-cardgen/reflected-xss-in-smartvista-cardgen-version-3.28.0-cve-2022-35554 · Exploit
• https://bdu.fstec.ru/vul/2022-05275 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35554 · Security Note
• https://vuldb.com/ru/?id.206868 · Note
• http://smartvista.com · Note
• http://bpcbt.com · Note