CVE-2022-37952

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-379536.1An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow anCVE-2022-379547.8DirectX Graphics Kernel Elevation of Privilege VulnerabilityCVE-2022-379557.8Windows Group Policy Elevation of Privilege VulnerabilityCVE-2022-379567.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-379577.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-379588.1SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution VulnerabilityCVE-2022-379596.5Network Device Enrollment Service (NDES) Security Feature Bypass VulnerabilityCVE-2022-379618.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2022-379627.8Microsoft PowerPoint Remote Code Execution VulnerabilityCVE-2022-379637.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-379647.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-379655.9Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
CVE-2022-37952: Medium severity, CVSS 6.1 | Vulnix