XSS in User Interface
CVE-2022-35632

4.8MEDIUM

Key Information:

Vendor: Rapid7
Status: Velociraptor
Vendor: CVE Published:; 29 July 2022

What is CVE-2022-35632?

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.

Affected Version(s)

Velociraptor 0.6.5-2

References

https://www.rapid7.com/blog/post/2022/07/26/cve-2022-3562...

x_refsource_CONFIRM

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 29, 2022
Vulnerability Reserved
Jul 11, 2022

Credit

Issue identified and disclosed by Tim Goddard of CyberCX during a security code review