CVE-2022-36533
MediumCVSS 5.4Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Syncovery 9 for Linux version 9.47x and below contains a cross-site scripting (XSS) vulnerability. This flaw could allow an attacker to inject malicious scripts into the user interface.
Risk Assessment
The risk includes potential session hijacking, data theft, or unauthorized actions performed in the context of the victim's browser.
Recommendation
It is recommended to immediately update Syncovery to a version newer than 9.47x that includes a fix for the XSS vulnerability.
Other vulnerabilities in Syncovery
See all- CVE-2022-36536Critical
A vulnerability in the post_applogin.php component of Syncovery 9 for Linux version 9.47x and below allows attackers to escalate privileges by crafting malicious session tokens.
- CVE-2022-36534High
Multiple remote code execution (RCE) vulnerabilities were discovered in Syncovery 9 for Linux version 9.47x and below via the Job_ExecuteBefore and Job_ExecuteAfter parameters in post_profilesettings.php.
Original NVD description (English source)
Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability.