Vulnerability-Lookup

CERTFR-2022-AVI-630

Vulnerability from certfr_avis - Published: 2022-07-13 - Updated: 2022-07-13

Une vulnérabilité a été découverte dans Veeam Management Pack. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Veeam Management Pack for Microsoft System Center version 8.0

L'éditeur rappelle qu'il ne propose plus de correctif pour Veeam Management Pack for Microsoft System Center version 8.0 et conseille de mettre à jour à la dernière version supportée.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Veeam kb4338 du 12 juillet 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eVeeam Management Pack for Microsoft System Center version 8.0\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur rappelle qu\u0027il ne propose plus de correctif pour Veeam Management Pack for Microsoft System Center version 8.0\u00a0 et conseille de mettre \u00e0 jour \u00e0 la derni\u00e8re version support\u00e9e.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-32225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32225"
    }
  ],
  "initial_release_date": "2022-07-13T00:00:00",
  "last_revision_date": "2022-07-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-630",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-07-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Veeam Management Pack. Elle\npermet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0\ndistance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Veeam Management Pack",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Veeam kb4338 du 12 juillet 2022",
      "url": "https://www.veeam.com/kb4338"
    }
  ]
}

CVE-2022-32225 (GCVE-0-2022-32225)

Vulnerability from cvelistv5 – Published: 2022-07-14 14:51 – Updated: 2024-08-03 07:39

Summary

A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.

Severity ?

No CVSS data available.

CWE

CWE-79 - Cross-site Scripting (XSS) - DOM (CWE-79)

Assigner

hackerone

References

URL

Tags

https://www.veeam.com/kb4338

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Veeam Management Pack for Microsoft System Center	Affected: 8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:39:49.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.veeam.com/kb4338"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Veeam Management Pack for Microsoft System Center",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site Scripting (XSS) - DOM (CWE-79)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-14T14:51:29",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.veeam.com/kb4338"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2022-32225",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Veeam Management Pack for Microsoft System Center",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site Scripting (XSS) - DOM (CWE-79)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.veeam.com/kb4338",
              "refsource": "MISC",
              "url": "https://www.veeam.com/kb4338"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2022-32225",
    "datePublished": "2022-07-14T14:51:29",
    "dateReserved": "2022-06-01T00:00:00",
    "dateUpdated": "2024-08-03T07:39:49.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2022-AVI-630

Solution

CVE-2022-32225 (GCVE-0-2022-32225)

Tags

Sightings

Nomenclature