CVE-2022-28864 - An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section

Back Back to CVE browser

HIGH

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section

Published Jul 24, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.04%

Description

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1236

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33301
Advisory
https://www.gruppotim.it/it/footer/red-team.html
ExploitThird Party Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
Not Applicable

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33301		Advisory
https://www.gruppotim.it/it/footer/red-team.html		ExploitThird Party Advisory
https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html		Not Applicable

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 24, 2023

Updated Oct 24, 2024

Reserved Apr 8, 2022

Link CVE-2022-28864

CISA Vulnrichment

Updated Oct 24, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-28864

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jul 24, 2023

Updated Oct 24, 2024

Link EUVD-2022-33301

GitHub

No data