CVEvulnerability
CVE-2022-50802
5.1 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
Affected configurations
• etaplighting etap safety manager 1.0.0.32
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://cxsecurity.com/issue/WLB-2022090031 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/235743 Third Party Advisory
- https://packetstormsecurity.com/files/168339/ Third Party Advisory
- https://www.etaplighting.com/ Product, US Government Resource
- https://www.vulncheck.com/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php Third Party Advisory
- https://cxsecurity.com/issue/WLB-2022090031 Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php Third Party Advisory