{"id":"CVE-2022-50942","state":"PUBLISHED","title":"Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener","description":"Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.","publishedAt":"2026-02-01T12:15:52.927Z","updatedAt":"2026-02-03T16:41:08.477Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Incinga Incinga Web"],"affected":[{"vendor":"Incinga","product":"Incinga Web","defaultStatus":"unaffected","versions":[{"version":"2.8.2","status":"affected"}]}],"references":["https://www.vulnerability-lab.com/get_content.php?id=2273","https://icinga.com/","https://github.com/Icinga/icingaweb2","https://www.vulncheck.com/advisories/inciga-web-client-side-cross-site-scripting-via-eventlistener"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50942.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50942","state":"PUBLISHED","datePublished":"2026-02-01T12:15:52.927Z","dateUpdated":"2026-02-03T16:41:08.477Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-11T13:34:26.330Z"},"containers":{"cna":{"title":"Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener","descriptions":[{"lang":"en","value":"Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks."}],"affected":[{"vendor":"Incinga","product":"Incinga Web","defaultStatus":"unaffected","versions":[{"version":"2.8.2","status":"affected"}]}],"references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2273","name":"Vulnerability Lab Advisory","tags":["exploit"]},{"url":"https://icinga.com/","name":"Product Homepage","tags":["product"]},{"url":"https://github.com/Icinga/icingaweb2","name":"Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/inciga-web-client-side-cross-site-scripting-via-eventlistener","name":"VulnCheck Advisory: Inciga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":4.8,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-02-02T16:15:25.794Z"},"credits":[{"lang":"en","type":"finder","value":"Vulnerability-Lab [Research Team]"}],"datePublic":"2022-04-07T00:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2273","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-03T16:34:59.415962Z","id":"CVE-2022-50942","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-03T16:41:08.477Z"}}]}}}