{"id":"CVE-2022-29034","aliases":["EUVD-2022-33464","GHSA-q48w-8cwv-r4h4"],"status":"published","title":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An...","description":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.\r\n\r\nThis could allow attackers to perform reflected cross-site scripting (XSS) attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.28732,"percentile":0.98155,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-06-14T09:21:45Z","modified":"2026-06-17T04:39:28Z","products":[{"vendor":"siemens","product":"sinema remote connect server"},{"vendor":"siemens","product":"sinema_remote_connect_server"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Jun/35","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-484086.html","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29034"},{"url":"https://github.com/advisories/GHSA-q48w-8cwv-r4h4"}],"sources":{"cve":[{"id":"CVE-2022-29034","description":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.\r\n\r\nThis could allow attackers to perform reflected cross-site scripting (XSS) attacks.","status":"published","published":"2022-06-14T09:21:45Z","modified":"2024-08-03T06:10:58.431Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-33464","description":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.\r\n\r\nThis could allow attackers to perform reflected cross-site scripting (XSS) attacks.","status":"published","published":"2022-06-14T09:21:45Z","modified":"2024-08-03T06:10:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-q48w-8cwv-r4h4","title":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An...","description":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks.","status":"published","published":"2022-06-15T00:00:28Z","modified":"2024-07-09T12:31:56Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:57:39.788243Z"}],"nvd":[{"id":"CVE-2022-29034","description":"A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.\r\n\r\nThis could allow attackers to perform reflected cross-site scripting (XSS) attacks.","status":"published","published":"2022-06-14T10:15:20.207Z","modified":"2026-06-17T04:39:28.693Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:22.232533Z"}]}}