medium4.8
CVE-2022-26494
An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1.
Impact
An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. JavaScript code must be used in a worker name before a Generate CSR request. Only an administrator can update a worker name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Primekey | Signserver | before 5.8.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.keyfactor.com/signserver/
- https://support.keyfactor.com/hc/en-us/articles/15618125602715-Security-Advisory-SignServer-Cross-site-scripting-issue-in-Admin-Web
- https://doc.primekey.com/signserver
- https://support.primekey.com/news/posts/signserver-security-advisory-cross-site-scripting-issue-in-admin-web