« Volver al listado

CVE-2022-1293

Estado: ModificadaMedia (6.1)—

The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thalesgroup — Citadel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1293",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@thalesgroup.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@thalesgroup.com",
      "affectedData": [
        {
          "vendor": "Thales",
          "product": "Citadel Web Client",
          "versions": [
            {
              "status": "affected",
              "version": "7.1.1",
              "lessThan": "7.1.2",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Web Client"
          ]
        },
        {
          "vendor": "Thales",
          "product": "Citadel Macosx Desktop Client",
          "versions": [
            {
              "status": "affected",
              "version": "7.1.1",
              "lessThan": "7.1.2",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Macosx"
          ]
        },
        {
          "vendor": "Thales",
          "product": "Citadel Windows Desktop Client",
          "versions": [
            {
              "status": "affected",
              "version": "7.1.1",
              "lessThan": "7.1.2",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ]
        }
      ]
    }
  ],
  "published": "2022-08-02T16:15:09.900",
  "references": [
    {
      "url": "https://www.ercom.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@thalesgroup.com"
    },
    {
      "url": "https://www.ercom.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@thalesgroup.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions."
    },
    {
      "lang": "es",
      "value": "Una neutralización insertada de la etiqueta HTML relacionada con los scripts, es pasado por alto en el caso de algunas condiciones adicionales"
    }
  ],
  "lastModified": "2026-06-17T04:22:10.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thalesgroup:citadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "842390C9-95EA-4D1B-BF23-30706C92564D",
              "versionEndExcluding": "7.1.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@thalesgroup.com"
}