PT-2023-12955 · Nokia · Nokia Netact

Andrea Carlo Maria Dattola + 2 · Published 2023-07-24 · Updated 2023-08-02 · CVE-2022-28865

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nokia NetAct version 22

Description An issue was discovered in the Site Configuration Tool website section, where a malicious user can change the filename of an uploaded file to include JavaScript code. This code is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. The API endpoint "/netact/sct" with the filename parameter is used for this purpose.

Recommendations For Nokia NetAct version 22, consider disabling the ability to upload files through the Site Configuration Tool website section until a patch is available. Restrict access to the "/netact/sct" API endpoint to minimize the risk of exploitation. Avoid using the filename parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28865

Affected Products

Nokia Netact

References · 6

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-28865 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28865 · Vendor Advisory
• https://t.me/cibsecurity/67150 · Telegram Post
• https://telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html · Note
• https://t.me/cvenotify/55040 · Telegram Post