Unsafe HTML Injection in Artifact Collection Report
CVE-2022-35630

6.1MEDIUM

Key Information:

Vendor

Rapid7

Status
Velociraptor
Vendor
CVE Published:
29 July 2022

What is CVE-2022-35630?

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2.

Affected Version(s)

Velociraptor 0.6.5-2

References

https://www.rapid7.com/blog/post/2022/07/26/cve-2022-3562...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
.
CVE-2022-35630 : Unsafe HTML Injection in Artifact Collection Report