CVE-2022-26962: XSS
Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NPBCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the Multiple Stored XSS (injecting arbitrary JavaScript) in Italtel NFV by preventing or restricting authenticated access to the affected page/function: NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS (e.g., restrict access to this UI endpoint so fewer users can trigger stored payloads).
Event History
Frequently Asked Questions
Who is exposed to the stored script payload?
Authenticated users who browse the page containing the malicious announcement are exposed, because the injected JavaScript is triggered whenever they view that page.
What does an attacker need to exploit this issue?
The attacker needs the ability to submit a malicious value through the affected announcement fields: name, username, or mrfAnnouncementName. The provided information does not state whether authentication or a particular role is required to create or modify these values.
Which component and endpoint should be investigated?
Review the NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp endpoint when used with opration=list and object=announcementAS. Inspect stored announcement data, especially the name, username, and mrfAnnouncementName values, for unexpected script content.