CVE-2022-3442

Crealogix EBICS ebics.aspx cross site scripting

3.5LowCVSS base score
0.59%Exploitation in 30 daysEPSS · top 51% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

A vulnerability was found in Crealogix EBICS 7.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ebics-server/ebics.aspx. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-210374 is the identifier assigned to this vulnerability.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

2022
10 Oct 2022
10 Oct 2022
Published
2025
15 Apr 20253 years later
15 Apr 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-3442, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Low3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
NVDNVD · Modified	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.59% · top 51% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Affected products

Crealogix · EBICS
- affected 7.0

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-3442](https://cveledger.app/badge/CVE-2022-3442.svg)](https://cveledger.app/cve/CVE-2022-3442)

Record last updated 15 Apr 2025, 13:45 UTC.