CVE-2022-31470

EPSS 52.1%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 52.1%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

07 Jun 2022Published on NVD

08 Sep 2023Public PoC

Weaponization speed

458 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/174551/Axigen-10.5.0-4370c946-Cross-Site-Scripting.htmlunverified exploitdbwww.exploit-db.com/exploits/51722unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/174551/Axigen-10.5.0-4370c946-Cross-Site-Scripting.html https://axigen.com https://www.axigen.com/knowledgebase/Axigen-Mobile-WebMail-XSS-Vulnerability-CVE-2022-31470-_390.html