CVE-2022-23395

mediumPriorität · verfolgen · 24EPSS 0.011 · 66. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.14% (66th) EPSS

CVSS 4.3 · medium

Is it mine?

38 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · bewertet 2026-10-27

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSCALANCE WAM763-1 (6GK5763-1AL00-7DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM763-1 (6GK5763-1AL00-3AA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM763-1 (6GK5763-1AL00-3DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM763-1 (6GK5763-1AL00-7DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM763-1 (6GK5763-1AL00-3AA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM763-1 (6GK5763-1AL00-3DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
BehobenSCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1321USprimärCWE-1321USCWE-1321USCWE-1321US

betroffene Produkte (38)

Betroffene Produkte und Versionsbereiche.

Oracle Siebel CRM <=25.10alle Versionencert_bundDE
Oracle Siebel CRM <=25.11alle Versionencert_bundDE
Oracle Siebel CRM <=25.2alle Versionencert_bundDE
Oracle Siebel CRM <=25.9alle Versionencert_bundDE
Oracle Siebel CRM≤ 25.9cert_bundDE
Oracle Siebel CRM≤ 25.10cert_bundDE
Oracle Siebel CRM≤ 25.11cert_bundDE
Oracle Siebel CRM≤ 25.2cert_bundDE
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)alle Versionencisa_csaf_otUS
SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)alle Versionencisa_csaf_otUS
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)alle Versionencisa_csaf_otUS
SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)alle Versionencisa_csaf_otUS
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)alle Versionencisa_csaf_otUS
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)alle Versionencisa_csaf_otUS
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)alle Versionencisa_csaf_otUS
SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)alle Versionencisa_csaf_otUS
SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)alle Versionencisa_csaf_otUS
Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)< V2.0cisa_csaf_otUS
Siemens SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)< V2.0cisa_csaf_otUS
Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)< V2.0cisa_csaf_otUS

20 von 38 angezeigt

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-565386SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.02023-03-14csaf · siemens_psirtDE
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.
WID-SEC-W-2023-1614Tenable Security Nessus Network Monitor: Mehrere SchwachstellenDeutsch2023-06-29csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.
WID-SEC-W-2024-0691IBM License Metric Tool: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-03-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM License Metric Tool ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2026-0165Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-gcx5-3p5f-f8vpPrototype Pollution in jquery.cookie2022-03-03ghsa · osvUS
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
ICSA-23-080-07Siemens SCALANCE Third-Party2023-03-14icsa · cisa_csaf_otUS
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund cisa_csaf_ot siemens_psirt osv NVD CVE.org MITRE

veröffentlicht 2022-03-02geändert 2026-06-17

verwandt (708)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-34621US	—OT kritisch	7.23% (94th)	KEV	2026-04-11
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerab…
CVE-2019-0230US	critical9.8	96.9% (100th)	Exploit	2020-09-14
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2022-24760US	critical10.0	49.4% (99th)	Exploit	2022-03-12
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects…
CVE-2019-11358US	medium6.1	86.8% (100th)	Exploit	2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob…
CVE-2020-7774US	critical9.8	69.4% (99th)	—	2020-11-17
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

+703 weitere

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan