CVE-2022-34323: XSS
Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Filters and Display model features (OnlineBanking > Web Monitoring > Settings > Filters / Display models). The name of a filter or a display model is interpreted as HTML and can thus embed JavaScript code, which is executed when displayed. This is a stored XSS. Another issue is present in the Notification feature (OnlineBanking > Configuration > Notifications and alerts > Alerts ). The name of an alert is interpreted as HTML, and can thus embed JavaScript code, which is executed when displayed. This is a stored XSS. (Also, an issue is present in the File download feature, accessible via /OnlineBanking/cgi/isapi.dll/DOWNLOADFRS. When requesting to show the list of downloadable files, the contents of three form fields are embedded in the JavaScript code without prior sanitization. This is essentially a self-XSS.)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-34323?
CVE-2022-34323 refers to multiple XSS issues discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' browsers.
What is the severity of CVE-2022-34323?
The severity of CVE-2022-34323 is medium, with a CVSS score of 5.4.
How can an attacker exploit CVE-2022-34323?
An attacker can exploit CVE-2022-34323 by leveraging multiple XSS vulnerabilities in Sage XRT Business Exchange 12.4.302 to execute malicious JavaScript code in the context of other users' browsers.
How can I fix CVE-2022-34323?
To fix CVE-2022-34323, it is recommended to update Sage XRT Business Exchange to a version that addresses the XSS vulnerabilities. Additionally, practice good security hygiene by regularly applying patches and updates.
Is authentication required for an attacker to exploit CVE-2022-34323?
Yes, authentication is required for an attacker to exploit CVE-2022-34323 and reach the vulnerable features in Sage XRT Business Exchange.