CVE-2022-36311

Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpdesk.airspan.com/browse/TRN3-1694	Permissions Required Vendor Advisory
https://helpdesk.airspan.com/browse/TRN3-1694	Permissions Required Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:airspan:airvelocity_1500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:airspan:airvelocity_1500:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:12

Type	Values Removed	Values Added
References	~~() https://helpdesk.airspan.com/browse/TRN3-1694 - Permissions Required, Vendor Advisory~~	() https://helpdesk.airspan.com/browse/TRN3-1694 - Permissions Required, Vendor Advisory

Information

Published : 2022-08-16 01:15

Updated : 2024-11-21 07:12

NVD link : CVE-2022-36311

Mitre link : CVE-2022-36311

CVE.ORG link : CVE-2022-36311

JSON object : View

Products Affected

airspan

airvelocity_1500
airvelocity_1500_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-36311", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-08-16T01:15:13.960", "references": [{"url": "https://helpdesk.airspan.com/browse/TRN3-1694", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://helpdesk.airspan.com/browse/TRN3-1694", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models."}, {"lang": "es", "value": "Airspan AirVelocity 1500 versiones anteriores a de software 15.18.00.2511, es vulnerable a una inyecci\u00f3n que conlleva a un ataque det tipo XSS en el campo de comunidad SNMP de la interfaz de usuario de administraci\u00f3n web del eNodeB. Este problema puede afectar a otros modelos AirVelocity y AirSpeed."}], "lastModified": "2024-11-21T07:12:45.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:airspan:airvelocity_1500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F130B19-2EC0-46BE-905A-2694196798C7", "versionEndExcluding": "15.18.00.2511"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:airspan:airvelocity_1500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DB5DBFEA-0C64-4E87-A11E-6C850D4C87CE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve-assign@fb.com"}