Medium severity · published Dec 25, 2023
CVE-2022-41762
An issue was discovered in NOKIA NFM-T R19.9
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Network Functions Manager For Transport · Nokia
19.9 · source: NVD
Affected product
NF
Network Functions Manager For Transport
Nokia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41762
Exploit
https://www.gruppotim.it/it/footer/red-team.html
More from Network Functions Manager For Transport
8.8
CVE-2022-39822
In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter
8.8
CVE-2022-39818
In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter
6.5
CVE-2022-41761
An issue was discovered in NOKIA NFM-T R19.9
6.5
CVE-2022-41760
An issue was discovered in NOKIA NFM-T R19.9
6.5
CVE-2022-39820
In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and…