Vulnerability · Published Dec 14, 2022 · Assigned by CERTVDE
CVE-2022-3073Quaonos Schema ST4 example templates prone to XSS
Medium 6.1
In plain English
A medium-severity cross-site scripting in Schema ST4 example web templates from Quanos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 58.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Quanos | Schema ST4 example web templates | 1 – through 2 |
| Quanos | Schema ST4 example web templates | 1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N