Vulnerability · Published Mar 30, 2022 · Assigned by Profelis
CVE-2022-25620Stored Cross-Site Scripting (XSS)
Low 3.8
In plain English
A low-severity security flaw in SambaBox from Profelis IT Consultancy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Profelis IT Consultancy | SambaBox | 4.0 – through 4.0 |
Weakness: CWE-80 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
References
- https://www.sambabox.io/sambabox-surum-4-0/ x_refsource_CONFIRM