CVE-2022-37775

MediumCVSS 6.1

Published: 16/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.71%

49th percentile - higher than 49% of all known CVEs

Summary

XSS vulnerability in Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26 September 2019) allows injection of malicious script via the JSON parameter 'participant -> name' in the Printable Chat History feature.

Risk Assessment

An attacker can steal user sessions, redirect victims to malicious sites, or execute arbitrary JavaScript in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately update Genesys PureConnect to the latest version and apply input filtering and encoding for the 'participant -> name' parameter.

Original NVD description (English source)

Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.