CVE-2022-24238
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Risk Assessment
The risk includes session hijacking, credential theft, or unauthorized actions performed in the victim's context. This could compromise the confidentiality and integrity of data within the system.
Recommendation
Immediately update ACEweb Online Portal to the latest patched version. If unavailable, apply input validation and output encoding for the txtNmName1 parameter.
Other vulnerabilities in ACEweb Online Portal
See all- CVE-2022-24240Critical
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
- CVE-2022-24239Critical
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
- CVE-2022-24581High
A vulnerability in ACEweb Online Portal 3.5.065 allows an unauthenticated attacker to capture SMB hashes by specifying an external UNC path when uploading a file. The attacker can trick the victim server into disclosing the username and password hash of the user running the ACEweb Online software.
- CVE-2022-24241High
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
Original NVD description (English source)
ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS