CVE-2022-39195

MEDIUMNuclei

LISTSERV 17 - Reflected Cross Site Scripting (XSS)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-39195 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 4, 2025 · Source: CVE List

Proofs of concept

1

Catalogued exploits

ExploitDBLISTSERV 17 - Reflected Cross Site Scripting (XSS)ExploitDB exploitby Shaunt Der-GrigorianNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMLISTSERV 17 - Cross-Site ScriptingCVSS 6.1

LISTSERV 17 web interface contains a cross-site scripting vulnerability. An attacker can inject arbitrary JavaScript or HTML via the "c" parameter, thereby possibly allowing the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability.

WeaknessesCWE-79
Authorsarafatansari
Template tagscvecve2022xsslistservpacketstormlsoftvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:lsoft:listserv:17.0:*:*:*:*:*:*:*
Shodan: http.html:"LISTSERV"
Shodan: http.html:"listserv"
FOFA: body="listserv"
https://packetstormsecurity.com/files/170552/LISTSERV-17-Cross-Site-Scripting.html https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L https://packetstormsecurity.com/2301-exploits/listserv17-xss.txt https://nvd.nist.gov/vuln/detail/CVE-2022-39195 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3