CVE-2022-37462

Summary

A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.0 allows remote attackers to inject arbitrary web script or HTML via AttachmentId in the file-upload details.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://www.upstreamworks.com/support/notifications/
• https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploits

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.upstreamworks.com/support/notifications/
• https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploits

• ←Previous
• Next→