PT-2026-38658 · Unknown · Thruk Monitoring

Published 2026-05-08 · Updated 2026-05-10 · CVE-2022-23961

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Thruk Monitoring versions prior to 2.46.4

Description The login field of the login form is susceptible to reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute scripts in the victim's browser. Unauthenticated remote attackers can exploit this to target users of the monitoring interface.

Recommendations Update to version 2.46.4 or later. As a temporary workaround, restrict access to the login form to trusted networks to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23961

Affected Products

Thruk Monitoring

References · 6

• 🔥 https://herolab.usd.de/security-advisories/usd-2021-0034 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23961 · Security Note
• https://t.me/cveNotify/162743 · Telegram Post
• https://herolab.usd.de/security-advisories · Note
• https://twitter.com/CVEnew/status/2053559149804273720 · Twitter Post
• https://t.me/cveNotify/162666 · Telegram Post