CVE-2022-24573

MediumCVSS 6.1

Published: 03/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

45th percentile - higher than 45% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability in the admin interface of Element-IT HTTP Commander 7.0.0 allows unauthenticated users to gain admin access by injecting a malicious script in the User-Agent field.

Risk Assessment

An unauthenticated attacker can take over the admin panel, steal data, or perform unauthorized actions, posing a serious threat to system confidentiality and integrity.

Recommendation

Immediately update HTTP Commander to the latest version and apply input filtering and sanitization for the User-Agent field.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field.