CVE-2022-2035
Quick assessment
Affected
n/a Rustici Software SCORM Engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rusici Software SCORM Engine是美国Rusici Software公司的一个可集成的学习标准平台。为学习应用程序提供通用 API 以正确导入、启动和跟踪标准化的电子学习内容。 Rusici Software SCORM Engine 20.1.45.914之前版本、21.1.x版本至21.1.7.219之前版本存在安全漏洞，该漏洞源于 /defaultui/player/modern.html 文件中的 playerConfUrl 参数中存在反射型跨站点脚本 (XSS) 漏洞。攻
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-2035
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Rusici Software SCORM Engine 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rusici Software SCORM Engine是美国Rusici Software公司的一个可集成的学习标准平台。为学习应用程序提供通用 API 以正确导入、启动和跟踪标准化的电子学习内容。 Rusici Software SCORM Engine 20.1.45.914之前版本、21.1.x版本至21.1.7.219之前版本存在安全漏洞，该漏洞源于 /defaultui/player/modern.html 文件中的 playerConfUrl 参数中存在反射型跨站点脚本 (XSS) 漏洞。攻
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Rustici Software SCORM Engine | < 20.1.45.914, 21.1.x < 21.1.7.219 | - |
|
II. Public POCs for CVE-2022-2035
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-2035
请登录查看更多情报信息。
Other References for CVE-2022-2035 (1)
-
https://www.tenable.com/security/research/tra-2022-21 x_refsource_MISC
Same Patch Batch · n/a · 2022-06-09 · 24 CVEs total
| CVE-2019-25067 | 6.3 MEDIUM | Podman/Varlink API Privilege Escalation |
| CVE-2019-25070 | 3.5 LOW | WolfCMS User Add cross site scripting |
| CVE-2021-40668 | HTTP File Server 路径遍历漏洞 | |
| CVE-2022-32272 | OPSWAT MetaDefender Core 安全漏洞 | |
| CVE-2022-31214 | Firejail 权限许可和访问控制问题漏洞 | |
| CVE-2021-40961 | CMS Made Simple SQL注入漏洞 | |
| CVE-2022-32195 | EDX Open edX 跨站脚本漏洞 | |
| CVE-2022-25807 | IGEL Universal Management Suite 信任管理问题漏洞 | |
| CVE-2022-25806 | IGEL Universal Management Suite 信任管理问题漏洞 | |
| CVE-2022-25805 | IGEL Universal Management Suite 安全漏洞 | |
| CVE-2022-25804 | IGEL Universal Management Suite 安全漏洞 | |
| CVE-2022-31649 | ownCloud 安全漏洞 | |
| CVE-2022-30075 | TP-LINK AX50 代码注入漏洞 | |
| CVE-2021-40610 | Emlog 跨站脚本漏洞 | |
| CVE-2022-30898 | CSCMS Music Portal System 跨站请求伪造漏洞 | |
| CVE-2022-31386 | nbnbk 代码问题漏洞 | |
| CVE-2022-31390 | JIZHICMS 代码问题漏洞 | |
| CVE-2022-31393 | JIZHICMS 代码问题漏洞 | |
| CVE-2022-31830 | Kity Minder 代码问题漏洞 | |
| CVE-2022-31827 | Monsta FTP 代码问题漏洞 |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2022-2035
No comments yet