CVE-2022-23395

mediumpriority · track · 24EPSS 0.011 · 66 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.14% (66th) EPSS

CVSS 4.3 · medium

Is it mine?

38 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-27

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSCALANCE WAM763-1 (6GK5763-1AL00-7DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM763-1 (6GK5763-1AL00-3AA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM763-1 (6GK5763-1AL00-3DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)siemens_psirt
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM763-1 (6GK5763-1AL00-7DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM763-1 (6GK5763-1AL00-3AA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM763-1 (6GK5763-1AL00-3DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/
FixedSCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)cisa_csaf_ot
Update to V2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815650/

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1321USprimaryCWE-1321USCWE-1321USCWE-1321US

affected products (38)

Products and version ranges known to be affected.

Oracle Siebel CRM <=25.10all versionscert_bundDE
Oracle Siebel CRM <=25.11all versionscert_bundDE
Oracle Siebel CRM <=25.2all versionscert_bundDE
Oracle Siebel CRM <=25.9all versionscert_bundDE
Oracle Siebel CRM≤ 25.9cert_bundDE
Oracle Siebel CRM≤ 25.10cert_bundDE
Oracle Siebel CRM≤ 25.11cert_bundDE
Oracle Siebel CRM≤ 25.2cert_bundDE
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)all versionscisa_csaf_otUS
SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)all versionscisa_csaf_otUS
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)all versionscisa_csaf_otUS
SCALANCE WAM766-1 EEC (EU) (6GK5766-1GE00-7TA0)all versionscisa_csaf_otUS
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)all versionscisa_csaf_otUS
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)all versionscisa_csaf_otUS
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)all versionscisa_csaf_otUS
SCALANCE WUM766-1 (EU) (6GK5766-1GE00-3DA0)all versionscisa_csaf_otUS
SCALANCE WUM766-1 (US) (6GK5766-1GE00-3DB0)all versionscisa_csaf_otUS
Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)< V2.0cisa_csaf_otUS
Siemens SCALANCE WAM766-1 (EU) (6GK5766-1GE00-7DA0)< V2.0cisa_csaf_otUS
Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)< V2.0cisa_csaf_otUS

showing 20 of 38

advisories (6)

Vendor and ecosystem advisories describing this.

SSA-565386SSA-565386: Third-Party Component Vulnerabilities in SCALANCE W-700 IEEE 802.11ax devices before V2.02023-03-14csaf · siemens_psirtDE
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.
WID-SEC-W-2023-1614Tenable Security Nessus Network Monitor: Mehrere SchwachstellenDeutsch2023-06-29csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.
WID-SEC-W-2024-0691IBM License Metric Tool: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-03-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM License Metric Tool ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2026-0165Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-gcx5-3p5f-f8vpPrototype Pollution in jquery.cookie2022-03-03ghsa · osvUS
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
ICSA-23-080-07Siemens SCALANCE Third-Party2023-03-14icsa · cisa_csaf_otUS
Multiple vulnerabilities affecting various third-party components of SCALANCE W-700 IEEE 802.11ax devices before V2.0 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for SCALANCE W-700 IEEE 802.11ax and recommends to update to the latest version.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund cisa_csaf_ot siemens_psirt osv NVD CVE.org MITRE

published 2022-03-02modified 2026-06-17

related (708)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-34621US	—OT critical	7.23% (94th)	KEV	2026-04-11
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerab…
CVE-2019-0230US	critical9.8	96.9% (100th)	Exploit	2020-09-14
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2022-24760US	critical10.0	49.4% (99th)	Exploit	2022-03-12
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects…
CVE-2019-11358US	medium6.1	86.8% (100th)	Exploit	2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob…
CVE-2020-7774US	critical9.8	69.4% (99th)	—	2020-11-17
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

+703 more

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan