Vulnerability · Published Jul 29, 2022 · Assigned by rapid7
CVE-2022-35632XSS in User Interface
Medium 4.8
In plain English
A medium-severity cross-site scripting in Velociraptor from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Velociraptor | 0.6.5-2 – before 0.6.5-2 |
Weakness: CWE-79