Lucene search

TMLCVE-2022-40289

HistoryOct 31, 2022 - 9:15 p.m.

CVE-2022-40289

2022-10-3121:15:12

CWE-79

TML

web.nvd.nist.gov

cve-2022-40289

authenticated

stored

xss

upload

download

privilege escalation

account compromise

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.

Affected configurations

Nvd

Node

phppointofsalephp_point_of_saleMatch19.0

VendorProductVersionCPE
phppointofsalephp_point_of_sale19.0cpe:2.3:a:phppointofsale:php_point_of_sale:19.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phppointofsale	php_point_of_sale	19.0	cpe:2.3:a:phppointofsale:php_point_of_sale:19.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PHP Point of Sale",
    "vendor": "PHP Point of Sale LLC",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ]
  }
]

References

www.themissinglink.com.au/security-advisories/cve-2022-40289

Social References

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2022-40289