Reflected Cross-Site Scripting Vulnerability in Proxmox Virtual Environment
CVE-2022-31358

9CRITICAL

Key Information:

Vendor

Proxmox

Status
Virtual Environment
Vendor
CVE Published:
14 December 2022

What is CVE-2022-31358?

The Proxmox Virtual Environment contains a reflected cross-site scripting (XSS) vulnerability affecting versions prior to 7.2-3. This vulnerability allows remote attackers to execute arbitrary web scripts or HTML code through non-existent API endpoints located under the path /api2/html/. Successful exploitation can compromise the integrity of web applications, leading to unauthorized access and data exposure.

References

http://proxmox.com
https://git.proxmox.com/?p=pve-http-server.git%3Ba=commit...
https://www.proxmox.com/en/

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.