{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-08-19T20:07:49", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.flir.com/products/ax8-automation/"}, {"tags": ["x_refsource_MISC"], "url": "https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-37063", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.flir.com/products/ax8-automation/", "refsource": "MISC", "url": "https://www.flir.com/products/ax8-automation/"}, {"name": "https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899", "refsource": "MISC", "url": "https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899"}, {"name": "http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:21:32.841Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.flir.com/products/ax8-automation/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-37063", "datePublished": "2022-08-18T17:09:51", "dateReserved": "2022-08-01T00:00:00", "dateUpdated": "2024-08-03T10:21:32.841Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:flir:flir_ax8_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "585EFD55-2D2F-4488-AE42-6BA5562FB3A6", "versionEndIncluding": "1.46.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:flir:flir_ax8:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A4DACB7-0558-4C74-8EDB-39591236ADEE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code."}, {"lang": "es", "value": "Todas las versiones de las c\u00e1maras de sensor t\u00e9rmico FLIR AX8 versiones hasta 1.46.16 incluy\u00e9ndola, son vulnerables a un ataque de tipo Cross Site Scripting (XSS) debido a un saneo inapropiado de la entrada. Un atacante remoto autenticado puede ejecutar c\u00f3digo JavaScript arbitrario en la interfaz de administraci\u00f3n web. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante insertar c\u00f3digo JavaScript malicioso."}], "id": "CVE-2022-37063", "lastModified": "2022-10-26T17:01:39.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-18T18:15:08.403", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://packetstormsecurity.com/files/168116/FLIR-AX8-1.46.16-Traversal-Access-Control-Command-Injection-XSS.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://gist.github.com/Nwqda/9e16852ab7827dc62b8e44d6180a6899"}, {"source": "cve@mitre.org", "tags": ["Product", "Vendor Advisory"], "url": "https://www.flir.com/products/ax8-automation/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}