CVE-2022-43710

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-437116.1Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) beCVE-2022-437126.5POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an CVE-2022-437137.5Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validCVE-2022-437167.5A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-CVE-2022-437175.4Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be perCVE-2022-437185.4Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users witCVE-2022-437198.8Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache SupersCVE-2022-43727.2The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leadingCVE-2022-437205.4An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escapedCVE-2022-437215.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to thiCVE-2022-437227.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing lCVE-2022-437237.5A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software d
CVE-2022-43710: High severity, CVSS 8.8 | Vulnix