1. Home
  2. CVE Database
  3. CVE-2022-36783
MEDIUM · 6.5

CVE-2022-36783

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the...

Vulnerability Description

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
AlgosecFireflow>= a32.0, < a32.0.580-277

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2022-36783?

CVE-2022-36783 is a vulnerability with a CVSS score of 6.5 (MEDIUM). AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the...

How severe is CVE-2022-36783?

CVE-2022-36783 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-36783?

Check the references section above for vendor advisories and patch information. Affected products include: Algosec Fireflow.