CVE-2022-37462

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.0 allows remote attackers to inject arbitrary web script or HTML via AttachmentId in the file-upload details.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploitsExploit, Third Party Advisory
https://www.upstreamworks.com/support/notifications/Vendor Advisory
https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploitsExploit, Third Party Advisory
https://www.upstreamworks.com/support/notifications/Vendor Advisory

Timeline

Published: Apr 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-37476.5The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss CVE-2022-37489.8Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management:CVE-2022-37504.7The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-37519.8SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.CVE-2022-37527.5An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-CVE-2022-37534.8The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as CVE-2022-37549.8Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-37585.4An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.CVE-2022-37597.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before CVE-2022-375989.8Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor CVE-2022-375997.5A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.CVE-2022-37609.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med. This issue af