CVE-2022-24238

MediumCVSS 6.1

Published: 02/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

40th percentile - higher than 40% of all known CVEs

Summary

ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes session hijacking, credential theft, or unauthorized actions performed in the victim's context. This could compromise the confidentiality and integrity of data within the system.

Recommendation

Immediately update ACEweb Online Portal to the latest patched version. If unavailable, apply input validation and output encoding for the txtNmName1 parameter.

Original NVD description (English source)

ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.