CVE-2022-25172 Vulnerability Details

  /     /     /  

CVE-2022-25172 Metadata Quick Info

CVE Published: 12/05/2022 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: talos | Vendor: InHand Networks | Product: InRouter302
Status : PUBLISHED

---

CVE-2022-25172 Description

An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-1004
CWE Name: CWE-1004: Sensitive Cookie Without HttpOnly Flag
Source: InHand Networks

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).