CVE-2022-30777

Deeper analysis

Parallels H-Sphere version 3.6.1713 contains a cross-site scripting vulnerability tracked as CVE-2022-30777 and assigned CWE-79. The flaw resides in the index_en.php script and is triggered through the from parameter, allowing injection of untrusted content into web responses. It received a CVSS 3.1 base score of 6.1 reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated remote attacker can supply a crafted link or input that causes the application to reflect attacker-controlled script in a victim's browser session. Successful exploitation can result in limited disclosure or modification of information within the affected page context, though availability is not impacted.

The supplied references consist of a Wikipedia entry on H-Sphere and a technical write-up on the issue; neither contains official patch details or mitigation guidance. The associated EPSS score has remained low, reaching a modest peak of 0.0560 before receding to its current value of 0.0415.