CVE-2022-28864

HIGH

Nokia NetAct 22 - CSV Injection via Administration of Measurements TemplateName Parameter

Title source: llm
STIX 2.1

Description

An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. A malicious user can edit or add the templateName parameter in order to include malicious code, which is then downloaded as a .csv or .xlsx file and executed on a victim machine. Here, the /aom/html/EditTemplate.jsf and /aom/html/ViewAllTemplatesPage.jsf templateName parameter is used.

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0086
EPSS Percentile 53.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-1236
Status published
Products (1)
nokia/netact 22.0.0.62
Published Jul 24, 2023
Tracked Since Feb 18, 2026