Back to Database
Status published
Medium
CVE-2022-22126
Openmct XSS via the “Web Page” element
Vulnerability Description
Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22126
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Daniel Elkabes
More from nasa
View All →CVE-2025-64096
CryptoLib vulnerable to Stack Buffer Overflow in Crypto_Key_Update due to missing TLV length check
High
8.8
CVE-2025-59534
CryptoLib command Injection vulnerability in initialize_kerberos_keytab_file_login()
High
7.3
CVE-2025-54878
Heap Buffer Overflow in NASA CryptoLib 1.4.0 `Crypto_TC_Check_IV_Setup`
High
8.6
CVE-2025-30356
Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity`
Critical
9.3
CVE-2025-30216
CryptoLib Has Heap Overflow in Crypto_TM_ProcessSecurity due to Unchecked Secondary Header Length
Critical
9.4
Affected Vendor
nasa
View all reports →Affected Software
openmct
Vulnerable Versions:
1.7.7, 1.3.0
Timeline
Official Publish:
February 20th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N