Cross-Site Scripting in Nokia NetAct Administration of Measurements

CVE-2022-28867

Summary

A vulnerability has been identified in Nokia NetAct 22, allowing a malicious user to modify the templateName parameter on the Administration of Measurements web interface. This weakness can lead to the injection of malicious JavaScript code, which is then executed in the web browser of an unsuspecting victim. Attackers commonly exploit this vulnerability by including the harmful script in URLs that may be shared publicly or sent directly via email. Key endpoints affected include /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf, making the potential for exploitation particularly concerning for users interacting with these pages.

References