Lucene search

MitreCVE-2022-36266

HistoryAug 08, 2022 - 3:15 p.m.

CVE-2022-36266

2022-08-0815:15:08

CWE-79

mitre

web.nvd.nist.gov

cve-2022-36266

airspan airspot 5410

stored xss

vulnerability

nvd

security_issue

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.8%

JSON

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.

Affected configurations

Nvd

Node

airspanairspot_5410_firmwareRange≤0.3.4.1-4

AND

airspanairspot_5410Match-

VendorProductVersionCPE
airspanairspot_5410_firmware*cpe:2.3:o:airspan:airspot_5410_firmware:*:*:*:*:*:*:*:*
airspanairspot_5410-cpe:2.3:h:airspan:airspot_5410:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
airspan	airspot_5410_firmware	*	cpe:2.3:o:airspan:airspot_5410_firmware::::::::
airspan	airspot_5410	-	cpe:2.3:h:airspan:airspot_5410:-:::::::*

References

packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html

gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833

wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf

Social References

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.8%

JSON

Related for CVE-2022-36266