CVE-2022-1226

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-1226", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2022-04-04T10:41:01.205Z", "datePublished": "2024-11-15T10:57:20.597Z", "dateUpdated": "2024-11-15T20:59:32.661Z"}, "containers": {"cna": {"title": "Cross-site Scripting (XSS) in phpipam/phpipam", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-11-15T10:57:20.597Z"}, "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts."}], "affected": [{"vendor": "phpipam", "product": "phpipam/phpipam", "versions": [{"version": "unspecified", "lessThan": "1.4.7", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/3fdcf653-fe26-4592-94a1-98ce664618ec"}, {"url": "https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc684748da378002"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79"}]}], "source": {"advisory": "3fdcf653-fe26-4592-94a1-98ce664618ec", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "phpipam", "product": "phpipam", "cpes": ["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.4.7", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-15T20:58:44.943024Z", "id": "CVE-2022-1226", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T20:59:32.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-1226", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-15T20:58:44.943024Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"], "vendor": "phpipam", "product": "phpipam", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.7", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-15T20:59:27.691Z"}}], "cna": {"title": "Cross-site Scripting (XSS) in phpipam/phpipam", "source": {"advisory": "3fdcf653-fe26-4592-94a1-98ce664618ec", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "phpipam", "product": "phpipam/phpipam", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "1.4.7", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/3fdcf653-fe26-4592-94a1-98ce664618ec"}, {"url": "https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc684748da378002"}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-11-15T10:57:20.597Z"}}}, "cveMetadata": {"cveId": "CVE-2022-1226", "state": "PUBLISHED", "dateUpdated": "2024-11-15T20:59:32.661Z", "dateReserved": "2022-04-04T10:41:01.205Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-11-15T10:57:20.597Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "phpipam/phpipam", "vendor": "phpipam", "versions": [{"lessThan": "1.4.7", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}, {"affectedData": [{"cpes": ["cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "phpipam", "vendor": "phpipam", "versions": [{"lessThan": "1.4.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*", "matchCriteriaId": "423B42AB-F118-4DFE-89ED-2480875972AE", "versionEndExcluding": "1.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en las versiones de phpipam/phpipam anteriores a la 1.4.7 permite a los atacantes ejecutar c\u00f3digo JavaScript arbitrario en el navegador de una v\u00edctima. Esta vulnerabilidad afecta a la funci\u00f3n de importaci\u00f3n de conjuntos de datos mediante la carga de un archivo de hoja de c\u00e1lculo. Los endpoints afectados incluyen import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php e import-l2dom-preview.php. La vulnerabilidad se puede explotar cargando un archivo de hoja de c\u00e1lculo especialmente manipulado que contenga payloads de JavaScript maliciosaos, que luego se ejecutan en el contexto del navegador de la v\u00edctima. Esto puede provocar la desfiguraci\u00f3n de sitios web, la ejecuci\u00f3n de c\u00f3digo JavaScript malicioso, el robo de cookies de usuario y el acceso no autorizado a las cuentas de usuario."}], "id": "CVE-2022-1226", "lastModified": "2026-06-17T04:22:02.937", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-1226", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-15T20:58:44.943024Z", "version": "2.0.3"}}]}, "published": "2024-11-15T11:15:07.527", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc684748da378002"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/3fdcf653-fe26-4592-94a1-98ce664618ec"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{}

{}