CVE-2022-38754 CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)
Authenticated users can execute arbitrary JavaScript in other users' browsers, potentially leading to session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-38754?
CVE-2022-38754 is a high-severity cross-site scripting vulnerability in Micro Focus Operations Bridge Manager, published on 8 Dec 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
Weakness: CWE-79
Which versions are affected by CVE-2022-38754?
It affects 2 products.
Products include Microfocus Operations Bridge, Microfocus Operations Bridge Manager.
How do I fix CVE-2022-38754?
No fix has been published for CVE-2022-38754 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-38754 being exploited?
There is no known exploitation of CVE-2022-38754 in the wild and no public exploit code.
Other vulnerabilities in Micro Focus Operations Bridge Manager
Sources
Also known as GHSA-cfjr-rrx2-8rp9.