Lucene search

TR-CERTCVE-2022-45091

HistoryFeb 12, 2023 - 4:15 a.m.

CVE-2022-45091

2023-02-1204:15:16

CWE-79

TR-CERT

web.nvd.nist.gov

cve-2022-45091

cross-site scripting

xss

group arge energy

control systems

smartpower web

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

23.5%

JSON

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting (XSS).This issue affects Smartpower Web: before 23.01.01.

Affected configurations

Nvd

Node

grupargesmartpower_webRange<23.01.01

VendorProductVersionCPE
grupargesmartpower_web*cpe:2.3:a:gruparge:smartpower_web:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gruparge	smartpower_web	*	cpe:2.3:a:gruparge:smartpower_web::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Smartpower Web",
    "vendor": "Group Arge Energy and Control Systems",
    "versions": [
      {
        "lessThan": "23.01.01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.usom.gov.tr/bildirim/tr-23-0066