« Volver al listado

CVE-2022-27237

Estado: ModificadaMedia (6.1)—

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

NI — FlexloggerNI — G WEB Development SoftwareNI — LabviewNI — Static Test Software SuiteNI — Systemlink

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-27237",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-21T05:15:06.800",
  "references": [
    {
      "url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en un componente de NI Web Server instalado con varios productos de NI. Dependiendo del producto(s) en uso, la guía de remediación incluye: instalar SystemLink versión 2021 R3 o posterior, instalar FlexLogger 2022 Q2 o posterior, instalar LabVIEW 2021 SP1, instalar G Web Development 2022 R1 o posterior, o instalar Static Test Software Suite versión 1.2 o posterior"
    }
  ],
  "lastModified": "2026-06-17T04:36:33.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ni:flexlogger:2021:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE96AE31-D36F-446A-96A5-46C762818A96"
            },
            {
              "criteria": "cpe:2.3:a:ni:flexlogger:2021:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "336F1E07-92EE-4BF5-AA14-981BFB67965C"
            },
            {
              "criteria": "cpe:2.3:a:ni:flexlogger:2021:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D3A4BF7-5BF0-4EE5-BF7C-8C514D6238B5"
            },
            {
              "criteria": "cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "135688EB-A45C-4837-8ADC-CE0E0393457D"
            },
            {
              "criteria": "cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF01F242-0C8B-457E-8116-6B144AEB94C2"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F46539B2-9084-45E3-B9D6-447C9E002C0C"
            },
            {
              "criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF15292D-3504-4386-BD9B-99A65FE22A2D"
            },
            {
              "criteria": "cpe:2.3:a:ni:static_test_software_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "738E76CB-643A-424E-85B0-65B6CFEB24B0",
              "versionEndExcluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:ni:systemlink:2020:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C507CEF-2AB1-4CF7-A66F-D3EAABA1D626"
            },
            {
              "criteria": "cpe:2.3:a:ni:systemlink:2022:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10ED5155-30C4-4278-82EF-DDEC2C12E9D5"
            },
            {
              "criteria": "cpe:2.3:a:ni:systemlink:2022:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "670B26C0-2ECE-4AC9-A3C2-3340D8F02040"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}