CVE-2022-32225 Cross-site scripting in Veeam Management Pack for Microsoft System Center
Reflected DOM-based XSS in Veeam Management Pack allows attackers to execute arbitrary scripts via crafted URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-32225?
CVE-2022-32225 is a medium-severity cross-site scripting vulnerability in Veeam Management Pack for Microsoft System Center, published on 14 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.
Weakness: CWE-79
Which versions are affected by CVE-2022-32225?
It affects 1 product.
Products include Veeam Management Pack.
How do I fix CVE-2022-32225?
No fix has been published for CVE-2022-32225 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-32225 being exploited?
There is no known exploitation of CVE-2022-32225 in the wild and no public exploit code.
Sources
Also known as GHSA-99rx-6xjh-gf5r.