CVE-2022-35554
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Multiple reflected XSS vulnerabilities were found in BPC SmartVista version 3.28.0. These flaws occur when handling error messages, allowing an attacker to execute JavaScript code on the client side.
Risk Assessment
An attacker can exploit these vulnerabilities to steal user sessions, redirect to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.
Recommendation
Immediately update BPC SmartVista to the latest patched version. Additionally, implement input validation and output encoding mechanisms in error messages.
Original NVD description (English source)
Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.