CVE-2022-44012

{"id": "CVE-2022-44012", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-12-25T05:15:10.547", "references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be decrypted."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId en Simmeth Lieferantenmanager antes de la versi\u00f3n 5.6. Un atacante puede ejecutar c\u00f3digo JavaScript en el navegador de la v\u00edctima si se carga un sitio. La contrase\u00f1a cifrada de la v\u00edctima puede ser robada y muy probablemente descifrada."}], "lastModified": "2022-12-30T22:03:46.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:simmeth:lieferantenmanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EBB9357-82B6-40F4-BD60-52AFCF6F183A", "versionEndExcluding": "5.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}