CVE-2022-21938 : Security Advisory and Response

A vulnerability in Metasys ADS/ADX/OAS could allow malicious code injection into the MUI Graphics web interface.

Understanding CVE-2022-21938

This CVE refers to a cross-site scripting (XSS) vulnerability in Metasys ADS/ADX/OAS servers.

What is CVE-2022-21938?

CVE-2022-21938 highlights a security issue where users could inject malicious code into the MUI Graphics web interface of affected versions of Metasys ADS/ADX/OAS servers.

The Impact of CVE-2022-21938

This vulnerability has a CVSS base score of 8.1 (High severity) and affects confidentiality, integrity, and requires high privileges for exploitation.

Technical Details of CVE-2022-21938

The following technical details provide insight into the vulnerability.

Vulnerability Description

The vulnerability allows users to inject malicious code into the MUI Graphics web interface of Metasys ADS/ADX/OAS versions prior to 10.1.5 and 11.0.2.

Affected Systems and Versions

All 10 versions before 10.1.5 and all 11 versions before 11.0.2 of Metasys ADS/ADX/OAS servers are impacted.

Exploitation Mechanism

The issue arises under certain circumstances, enabling attackers to inject malicious code via the MUI Graphics web interface.

Mitigation and Prevention

Take immediate action to secure your systems against CVE-2022-21938.

Immediate Steps to Take

Update all Metasys ADS/ADX/OAS 10 versions with the patch 10.1.5. Update all Metasys ADS/ADX/OAS 11 versions with the patch 11.0.2.

Long-Term Security Practices

Implement web security best practices to prevent XSS attacks on your web interfaces.

Patching and Updates

Regularly monitor security advisories and apply patches promptly to mitigate known vulnerabilities.