CVE-2022-36266

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36266
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html Broken Link
https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 Exploit Mitigation Third Party Advisory
https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf Product Third Party Advisory
http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html Broken Link
https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 Exploit Mitigation Third Party Advisory
https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf Product Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:airspan:airspot_5410_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:airspan:airspot_5410:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:12

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html - Broken Link () http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html - Broken Link
References () https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - Exploit, Mitigation, Third Party Advisory () https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - Exploit, Mitigation, Third Party Advisory
References () https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - Product, Third Party Advisory () https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - Product, Third Party Advisory

26 Oct 2022, 18:06

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html - (MISC) http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html - Broken Link

19 Aug 2022, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html -

12 Aug 2022, 14:59

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:h:airspan:airspot_5410:-:*:*:*:*:*:*:*
cpe:2.3:o:airspan:airspot_5410_firmware:*:*:*:*:*:*:*:*
References (MISC) https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - (MISC) https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - Product, Third Party Advisory
References (MISC) https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - (MISC) https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - Exploit, Mitigation, Third Party Advisory

08 Aug 2022, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-08 15:15

Updated : 2024-11-21 07:12

NVD link : CVE-2022-36266

Mitre link : CVE-2022-36266

CVE.ORG link : CVE-2022-36266

JSON object : View

Products Affected

airspan

  • airspot_5410
  • airspot_5410_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')