CVE-2022-31792

Published: Sep 6, 2022Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.

Affected (10)

Products: Watchguard: Fireware

Watchguard

1 product

Fireware

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Watchguard Fireware	From 12.0.0 to 12.1.4
Watchguard Fireware	From 12.2.0 to 12.5.10
Watchguard Fireware	Version 12.6.1 u1
Watchguard Fireware	Version 12.6.1 u3
Watchguard Fireware	Version 12.6.3
Watchguard Fireware	Version 12.6.4
Watchguard Fireware	Version 12.7.0 u1
Watchguard Fireware	Version 12.7.1
Watchguard Fireware	Version 12.7.2 u2
Watchguard Fireware	Version 12.8.0 u1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00014

Source: cve@mitre.org

Vendor Advisory

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00014

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.