CVE-2022-2140CWE-79

Elcomplus SmartICS Cross-site Scripting

High · published June 27, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00834 · 57.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-27T16:14Z
EPSS history
Timeline
  • 27 JUN 16:14Z
    Elcomplus SmartICS Cross-site Scripting
    cvelistv5