CVE-2022-38339

CRITICAL 9.6

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page.

Vendor	n/a
Product	n/a
Published	Sep 19, 2022
Last Updated	Aug 3, 2024

Stay Ahead of the Next One

Get instant alerts for n/a n/a

Be the first to know when new critical vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

n/a / n/a

n/a

References

NVD ↗ CVE.org ↗ EPSS Data ↗

community.safe.com: https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities cycura.com: https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/