CVE-2022-30571 TIBCO iWay Service Manager Reflected Cross Site Scripting (XSS) Vulnerability
A low-privileged attacker can execute scripts on the victim's system via reflected XSS in the TIBCO iWay Service Manager Console.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30571?
CVE-2022-30571 is a high-severity cross-site scripting vulnerability in TIBCO iWay Service Manager, published on 2 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
Weakness: CWE-79
Which versions are affected by CVE-2022-30571?
It affects 1 product.
Products include Tibco Iway Service Manager.
How do I fix CVE-2022-30571?
No fix has been published for CVE-2022-30571 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-30571 being exploited?
There is no known exploitation of CVE-2022-30571 in the wild and no public exploit code.
Other vulnerabilities in TIBCO iWay Service Manager
Sources
Also known as GHSA-qcfp-hf4h-7wpx.