CVE-2022-23350
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was discovered in BigAnt Server version 5.6.06. It allows an attacker to inject malicious scripts into web pages.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or other actions performed in the victim's browser context.
Recommendation
It is recommended to immediately update BigAnt Server to the latest available version that fixes this vulnerability.
Other vulnerabilities in BigAnt Server
See all- CVE-2022-23347High
BigAnt Server version 5.6.06 is vulnerable to directory traversal attacks, allowing an attacker to read files outside the server's root directory.
- CVE-2022-26281High
BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. This vulnerability may allow unauthorized users to access resources they should not have permissions to.
- CVE-2022-23352High
A vulnerability in BigAnt Server version 5.6.06 allows an attacker to perform a Denial of Service (DoS) attack, potentially causing service disruption.
- CVE-2022-23349High
BigAnt Server version 5.6.06 from BigAnt Software was found to contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to perform unauthorized actions on behalf of an authenticated user.
- CVE-2022-23348Medium
BigAnt Server version 5.6.06 uses weak password hashing functions, making password recovery easier.
- CVE-2022-23346High
BigAnt Server version 5.6.06 was found to have incorrect access control issues. This vulnerability may allow unauthorized users to access resources without proper permissions.
- CVE-2022-23345High
BigAnt Server version 5.6.06 was found to have incorrect access control. This vulnerability may allow unauthorized users to access resources without proper permissions.
Original NVD description (English source)
BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS