CVE-2022-50942

Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener

Summary

Original description

The description as published by the source.

Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.min.js file. Attackers can exploit the EventListener.handleEvent method to execute arbitrary scripts, potentially leading to session hijacking and non-persistent phishing attacks.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-50942 icingaweb2
Ubuntu UBUNTU-CVE-2022-50942 icingaweb2

References

advisory github.com
advisory nvd.nist.gov
advisory vulncheck.com
package github.com
report vulnerability-lab.com
web icinga.com

Metadata

CVE: CVE-2022-50942
Published: 2026-02-01
First seen on SecPulse: 8 months ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-79

Detection sources

OSV.dev (Open Source Vulnerabilities) 2 months ago