CVE-2022-50802 | THREATINT

Description

ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.

PUBLISHED Reserved 2025-12-27 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

1.0.0.32

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php (Zero Science Lab Disclosure (ZSL-2022-5711)) third-party-advisory

packetstormsecurity.com/files/168339/ (Packet Storm Security Exploit Entry) exploit

exchange.xforce.ibmcloud.com/vulnerabilities/235743 (IBM X-Force Vulnerability Exchange) vdb-entry

cxsecurity.com/issue/WLB-2022090031 (CXSecurity Vulnerability Database) third-party-advisory

www.etaplighting.com/ (ETAP Vendor Homepage) product

www.vulncheck.com/...oss-site-scripting-via-action-parameter (VulnCheck Advisory: ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter) third-party-advisory

cve.org (CVE-2022-50802)

nvd.nist.gov (CVE-2022-50802)

Download JSON