CVE-2022-50802 json
ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter
published 2025-12-30 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2022-55923
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts in victim browser sessions, potentially stealing credentials or performing unauthorized actions.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com https://packetstormsecurity.com/files/168339/ referenced PoC, tagged "exploit" by a source, unverified
- cxsecurity.com https://cxsecurity.com/issue/WLB-2022090031 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- ETAP Lighting International NV ETAP Safety Manager
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
zeroscience.mk
/en/vulnerabilities/ZSL-2022-5711.php
third-party-advisory, exploit
-
packetstormsecurity.com
/files/168339/
exploit, third-party-advisory
-
cxsecurity.com
/issue/WLB-2022090031
third-party-advisory, exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/235743
vdb-entry, third-party-advisory
-
etaplighting.com
/
product, us-government-resource
-
vulncheck.com
/advisories/etap-safety-manager-unauthenticated-reflected-cross-site-scripting-via-action-parameter
third-party-advisory
Sources
- CVE List CVE-2022-50802
- NVD CVE-2022-50802
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.