CVE-2022-34093

MEDIUMNuclei

Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-34093 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSoftware Publico Brasileiro i3geo v7.0.5 - Cross-Site ScriptingCVSS 6.1

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.

Impact

Attackers can inject malicious JavaScript through parameters in the LinkedIn OAuth access_token.php endpoint that executes in users' browsers, potentially stealing session tokens or performing unauthorized actions in the i3geo geographic information system.

Remediation

Update i3geo to a version later than 7.0.5 that properly sanitizes and encodes user input in access_token.php.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022i3geoxsssoftwarepublicovuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*
Shodan: http.html:"i3geo"
FOFA: body="i3geo"
https://nvd.nist.gov/vuln/detail/CVE-2022-34093 https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L44 https://owasp.org/www-community/attacks/xss/ https://softwarepublico.gov.br/social/i3geo https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

6