« Volver al listado

CVE-2022-35630

Estado: ModificadaMedia (6.1)—

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rapid7 — Velociraptor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35630",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Velociraptor",
          "versions": [
            {
              "status": "affected",
              "version": "0.6.5-2",
              "lessThan": "0.6.5-2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-29T17:15:09.427",
  "references": [
    {
      "url": "https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@rapid7.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2."
    },
    {
      "lang": "es",
      "value": "Un problema de tipo cross-site scripting (XSS) en la generación de un informe de colección hacía posible que clientes maliciosos inyectaran código JavaScript en el archivo HTML estático. Este problema se resolvió en Velociraptor versión 0.6.5-2"
    }
  ],
  "lastModified": "2026-06-17T04:52:00.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25500856-C930-4911-A709-292339FC5876",
              "versionEndExcluding": "0.6.5-2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@rapid7.com"
}