PT-2022-5026 · Unknown · Cert/Cc Vince

Sei-Vsarvepalli · Published 2022-10-10 · Updated 2023-07-10 · CVE-2022-40257

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CERT/CC VINCE versions prior to 1.50.4

Description An HTML injection issue exists due to the failure to neutralize special elements. This allows a remote attacker to inject arbitrary HTML code via a crafted email with HTML content in the Subject field. An authenticated attacker can exploit this to inject arbitrary HTML.

Recommendations For versions prior to 1.50.4, update to version 1.50.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML content in email subjects to minimize the risk of exploitation.

Fix

Open Redirect

Special Elements Injection

XSS

Weakness Enumeration

CWE-601

CWE-74

CWE-79

Related Identifiers

BDU:2022-06239

CVE-2022-40257

Affected Products

Cert/Cc Vince

References · 6

• https://bdu.fstec.ru/vul/2022-06239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40257 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40257 · Vendor Advisory
• https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity · Note
• https://t.me/cibsecurity/51071 · Telegram Post
• https://t.me/cvenotify/53973 · Telegram Post