CVE-2022-28172CWE-79

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability

Medium · published June 27, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00802 · 56.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-27T17:50Z
EPSS history
Timeline
  • 27 JUN 17:50Z
    The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability
    cvelistv5