Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for FireFlow A32.0 by AlgoSec

    CVE-2022-36783 (GCVE-0-2022-36783)

    Vulnerability from nvd – Published: 2022-10-25 00:50 – Updated: 2025-05-07 19:24
    VLAI
    Title
    AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)
    Summary
    AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-05-07 19:24 UTC
    CWE
    • Reflected Cross-Site-Scripting (RXSS)
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    AlgoSec FireFlow A32.0 Affected: A32.0.580-277 , < A32.0.580-277* (custom)
    		Create a notification for this product.
    AlgoSec FireFlow A32.10 Affected: A32.10.410-212 , < A32.10.410-212* (custom)
    		Create a notification for this product.
    AlgoSec FireFlow A32.20 Affected: A32.20.230-35 , < A32.20.230-35* (custom)
    		Create a notification for this product.
    Date Public
    2022-10-23 00:00
    Credits
    Dean Aviani - Hacktics EY
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:28.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-36783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T19:24:12.064274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:24:43.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FireFlow A32.0",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.0.580-277*",
              "status": "affected",
              "version": "A32.0.580-277",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "FireFlow A32.10",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.10.410-212*",
              "status": "affected",
              "version": "A32.10.410-212",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "FireFlow A32.20",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.20.230-35*",
              "status": "affected",
              "version": "A32.20.230-35",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dean Aviani - Hacktics EY"
        }
      ],
      "datePublic": "2022-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlgoSec \u2013 FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Reflected Cross-Site-Scripting (RXSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-26T00:00:00.000Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update released for the following versions:\nFor A32.0 : A32.0.580-277\nFor A32.10 : A32.10.410-212\nFor A32.20 : A32.20.230-35"
        }
      ],
      "source": {
        "defect": [
          "ILVN-2022-0054"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "AlgoSec \u2013 FireFlow Reflected Cross-Site-Scripting (RXSS)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2022-36783",
    "datePublished": "2022-10-25T00:50:05.722Z",
    "dateReserved": "2022-07-26T00:00:00.000Z",
    "dateUpdated": "2025-05-07T19:24:43.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2022-36783 (GCVE-0-2022-36783)

    Vulnerability from cvelistv5 – Published: 2022-10-25 00:50 – Updated: 2025-05-07 19:24
    VLAI
    Title
    AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)
    Summary
    AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-05-07 19:24 UTC
    CWE
    • Reflected Cross-Site-Scripting (RXSS)
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    AlgoSec FireFlow A32.0 Affected: A32.0.580-277 , < A32.0.580-277* (custom)
    		Create a notification for this product.
    AlgoSec FireFlow A32.10 Affected: A32.10.410-212 , < A32.10.410-212* (custom)
    		Create a notification for this product.
    AlgoSec FireFlow A32.20 Affected: A32.20.230-35 , < A32.20.230-35* (custom)
    		Create a notification for this product.
    Date Public
    2022-10-23 00:00
    Credits
    Dean Aviani - Hacktics EY
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:28.419Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-36783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T19:24:12.064274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:24:43.237Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FireFlow A32.0",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.0.580-277*",
              "status": "affected",
              "version": "A32.0.580-277",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "FireFlow A32.10",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.10.410-212*",
              "status": "affected",
              "version": "A32.10.410-212",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "FireFlow A32.20",
          "vendor": "AlgoSec",
          "versions": [
            {
              "lessThan": "A32.20.230-35*",
              "status": "affected",
              "version": "A32.20.230-35",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dean Aviani - Hacktics EY"
        }
      ],
      "datePublic": "2022-10-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AlgoSec \u2013 FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Reflected Cross-Site-Scripting (RXSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-26T00:00:00.000Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update released for the following versions:\nFor A32.0 : A32.0.580-277\nFor A32.10 : A32.10.410-212\nFor A32.20 : A32.20.230-35"
        }
      ],
      "source": {
        "defect": [
          "ILVN-2022-0054"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "AlgoSec \u2013 FireFlow Reflected Cross-Site-Scripting (RXSS)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2022-36783",
    "datePublished": "2022-10-25T00:50:05.722Z",
    "dateReserved": "2022-07-26T00:00:00.000Z",
    "dateUpdated": "2025-05-07T19:24:43.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}