CVE-2022-22812 — Cross-site Scripting in Fellerlynk Firmware

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 45.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Schneider-electric Fellerlynk FirmwareSchneider-electric Spacelynk FirmwareSchneider-electric Wiser FOR KNX Firmware
Timeline
PublishedFeb 9
Latest updateFeb 11

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session compromise when an attacker injects and then executes arbitrary malicious JavaScript code inside the target browser. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-f5p7-gfff-wrgp: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session com↗2022-02-11
▶
CVEList
CVE-2022-22812: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session com↗2022-02-09
▶
CVE-2022-22812 — Cross-site Scripting | cvebase