Medium severity · published Apr 11, 2022
CVE-2022-22571
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions
4.8
CVSS
0.9%
EPSS
No
On KEV
Description
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Incapptic Connect · Ivanti
through 1.40.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22571
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22571
Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/cve-2022-22571/
Mitigation
https://forums.ivanti.com/s/article/Security-Advisory-for-incapptic-Connect-SA-2022-03-11?language=en_US
More from Incapptic Connect
8.8
CVE-2022-22572
A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality
7.2
CVE-2022-21828
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic…