PT-2022-7036 · Veeam · Veeam Management Pack For Microsoft System Center

Mateusz Dabrowski · Published 2022-07-12 · Updated 2022-07-20 · CVE-2022-32225

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center version 8.0

Description A reflected DOM-Based XSS issue exists due to inadequate protection of the web page structure. This could allow a remote attacker to conduct cross-site scripting attacks by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, enabling the execution of arbitrary scripts.

Recommendations For Veeam Management Pack for Microsoft System Center version 8.0, consider restricting access to the Help directory until a patch is available. As a temporary workaround, avoid using crafted URLs that could exploit the reflected DOM-Based XSS vulnerability in the Help directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-07197

CVE-2022-32225

Affected Products

Veeam Management Pack For Microsoft System Center

References · 6

• https://bdu.fstec.ru/vul/2023-07197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-32225 · Security Note
• https://veeam.com/kb4338 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32225 · Vendor Advisory
• https://t.me/cibsecurity/46251 · Telegram Post
• https://t.me/cvenotify/33466 · Telegram Post