Back to Database
Status published
Medium
CVE-2022-40248
An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
Vulnerability Description
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-40248
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Rapid7 researcher Nick Sanzotta discovered and reported this security vulnerability to CERT/CC
More from CERT/CC
View All →CVE-2024-9953
Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
Unknown
0
CVE-2024-10469
CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
Unknown
0
CVE-2022-40257
An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
Medium
5.4
CVE-2022-40238
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
Unknown
0
CVE-2022-25799
An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0
Medium
6.1
Affected Vendor
CERT/CC
View all reports →Affected Software
VINCE - The Vulnerability Information and Coordination Environment
Vulnerable Versions:
1.48.0
Timeline
Official Publish:
October 10th, 2022
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N