PT-2022-6471 · Netapp · Active Iq Unified Manager

Pierre Vivegnis · CVE-2022-23239 · Published 2022-09-01 · Updated 2023-03-10

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1

Description The issue is related to a Stored Cross-Site Scripting (XSS) attack, which can be performed by administrative users. This is due to inadequate protection of the web page structure, allowing a remote attacker to conduct inter-site script attacks.

Recommendations For versions prior to 9.11P1, update to version 9.11P1 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01638

CVE-2022-23239

Affected Products

Active Iq Unified Manager

References · 6

• https://osv.dev/vulnerability/CVE-2022-23239 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23239 · Security Note
• https://t.me/cvenotify/45223 · Telegram Post
• https://t.me/cvenotify/45956 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220901-0001 · Note