CVE-2022-27237

Published: Apr 21, 2022Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

Affected (11)

Products: Ni: Flexlogger, G Web Development Software, Labview, Static Test Software Suite, Systemlink

5 products

Flexlogger

G Web Development Software

Labview

Static Test Software Suite

Systemlink

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Ni Flexlogger	Version 2021 r2
Ni Flexlogger	Version 2021 r3
Ni Flexlogger	Version 2021 r4
Ni G Web Development Software	Version 2021
Ni G Web Development Software	Version 2021
Ni Labview	Version 2021
Ni Labview	Version 2021
Ni Static Test Software Suite	Before 1.2
Ni Systemlink	Version 2020 r4
Ni Systemlink	Version 2022 r1
Ni Systemlink	Version 2022 r2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html

Source: cve@mitre.org

MitigationPatchVendor Advisory

https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchVendor Advisory

Timeline

No history available yet.