Paper/Archive/CVE-2022-25620

CVE-2022-25620

Profelis IT Consultancy SambaBox — Stored Cross-Site Scripting (XSS)

CVSS 9.0 (NVD)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 38.7.387 × 207.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.

Affected

ProductAffectedFixed inSource

SambaBox4.0 – 4.0–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Profelis (CNA)3.8CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

refsambabox.io/sambabox-surum-4-0