CVE-2022-50942
Client-Side XSS in Inciga 2.8.2 via icinga.min.js
Publication date: 2026-02-01
Last updated on: 2026-02-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| icinga | inciga_web | 2.8.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50942 is a client-side cross-site scripting (XSS) vulnerability in Inciga Web version 2.8.2. It occurs in the JavaScript file icinga.min.js, specifically in the EventListener.handleEvent method used to add new dashboard widgets. Remote attackers can inject malicious script code through input fields like title and url by sending crafted POST requests to the /Icinga-web/dashboard/new-dashlet endpoint. This injected script executes in the victim's browser, potentially leading to session hijacking, non-persistent phishing attacks, external redirects, and manipulation of application modules. The vulnerability arises because inputs are not properly sanitized or encoded. [3, 4]
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser session. This can lead to session hijacking, where attackers steal user session tokens to impersonate users, non-persistent phishing attacks by displaying malicious content, external redirects to malicious websites, and manipulation of application modules. These impacts can compromise user security and trust in the affected application. [3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint `/Icinga-web/dashboard/new-dashlet` that contain potentially malicious script injections in the `title`, `url`, or `content` parameters. Detection can involve inspecting web server logs or using web application firewalls (WAF) to identify such payloads. Specific commands might include using tools like `curl` to send crafted POST requests to test the vulnerability or using log analysis commands such as `grep` to search for suspicious script tags in logs. For example, you can use: `grep -i '<script>' /var/log/apache2/access.log` to find possible script injections in access logs. Additionally, sending a crafted POST request with a test payload using curl: `curl -X POST -d "title=<script>alert(1)</script>&url=test&content=test" https://your-icinga-web-instance/Icinga-web/dashboard/new-dashlet` can help verify if the vulnerability is present. [4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying patches or updates that securely encode inputs in the `icinga.min.js` file for the `title`, `url`, and `content` fields to prevent script injection. Restrict and sanitize user inputs to disallow special characters that enable script injection. If patches are not yet available, consider disabling or restricting access to the dashboard feature that handles new dashlets, especially the `/Icinga-web/dashboard/new-dashlet` endpoint, to reduce exposure. Additionally, implement web application firewall (WAF) rules to block malicious payloads targeting this vulnerability and educate users about the risk of phishing attacks resulting from exploitation. [4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary scripts, potentially leading to session hijacking and phishing attacks. Such security weaknesses can result in unauthorized access to sensitive data or user sessions, which may compromise the confidentiality and integrity of personal or protected information. This can negatively impact compliance with standards like GDPR and HIPAA that require protection of personal data and secure user authentication. However, specific compliance impacts are not detailed in the provided resources. [3, 4]