CVE-2022-21145 - A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2

Back Back to CVE browser

MEDIUM

A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2

Published Apr 14, 2022

4.8

MEDIUM

CVSS 3.1

EPSS 77.78%

Description

A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.

Affected products

Vendor Lansweeper Product Lansweeper Default
n/a
- Version
  9.1.20.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lansweeper

n/a

Version	Status	Constraints
9.1.20.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-80

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1442
x_refsource_MISCExploitThird Party Advisory
https://www.lansweeper.com/changelog/
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1442		x_refsource_MISCExploitThird Party Advisory
https://www.lansweeper.com/changelog/		x_refsource_CONFIRMRelease NotesVendor Advisory