CVE-2022-42753

{"id": "CVE-2022-42753", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-11-03T18:15:17.663", "references": [{"url": "https://fluidattacks.com/advisories/hardway/", "tags": ["Exploit", "Third Party Advisory"], "source": "help@fluidattacks.com"}, {"url": "https://salonerp.sourceforge.io/", "tags": ["Product"], "source": "help@fluidattacks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks."}, {"lang": "es", "value": "SalonERP versi\u00f3n 3.0.2 permite que un atacante externo robe las cookies de usuarios arbitrarios. Esto es posible porque la aplicaci\u00f3n no valida correctamente el par\u00e1metro de la p\u00e1gina contra ataques XSS."}], "lastModified": "2022-11-04T19:24:55.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:salonerp_project:salonerp:3.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2B72C03-6D8A-465B-9F61-6CB4BCBD6874"}], "operator": "OR"}]}], "sourceIdentifier": "help@fluidattacks.com"}