CVE-2022-45137

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-451389.8The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be ableCVE-2022-451395.3A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the weCVE-2022-45146.1A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of thCVE-2022-451409.8The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unCVE-2022-451419.8Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assuCVE-2022-451427.5The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to tCVE-2022-451437.5The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description vCVE-2022-451446.1Algoo Tracim before 4.4.2 allows XSS via HTML file upload.CVE-2022-451459.8egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egCVE-2022-451465.5An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and latCVE-2022-451477.8A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versiCVE-2022-451495.4A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's
CVE-2022-45137: Medium severity, CVSS 6.1 | Vulnix