CVE-2022-31358

CRITICAL
Published Dec 14, 20223y ago · Modified Jun 17, 20262w ago
9.0 CVSS 3.1
Critical
Find Similar
Published Dec 14, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.

CVSS Details

Base Score
9.0
Exploitability
2.3
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
proxmoxvirtual_environment* <7.2-3

References 4

  • proxmox.com http://proxmox.com
    Product
  • git.proxmox.com https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=00661f1223b7c0afffa64e1d91f5e018b985f762
  • starlabs.sg https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
    ExploitPatchTechnical DescriptionThird Party Advisory
  • proxmox.com https://www.proxmox.com/en/
    Product

Remediation

  • starlabs.sg https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
    ExploitPatchTechnical DescriptionThird Party Advisory