{"metadata": {"vulnerability": "CVE-2022-46620", "count": 8, "kinds": {"milestone": 2, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2022-12-05T00:00:00Z", "date_only": false, "value": "2022-12-05T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-46620", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-02-07T00:00:00Z", "date_only": false, "value": "2023-02-07T00:00:00.000Z", "kind": "other", "label": "Rejected", "source": "cvelistv5", "record": "CVE-2022-46620", "field": "cveMetadata.dateRejected"}, {"timestamp": "2023-02-07T00:00:00Z", "date_only": false, "value": "2023-02-07T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-46620", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2023-02-07T00:00:00Z", "date_only": false, "value": "2023-02-07T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2022-46620", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2023-02-07T16:15:08.677Z", "date_only": false, "value": "2023-02-07T16:15:08.677", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-46620", "record": "FKIE_CVE-2022-46620", "field": "published"}, {"timestamp": "2023-11-07T03:55:42.210Z", "date_only": false, "value": "2023-11-07T03:55:42.210", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-46620", "record": "FKIE_CVE-2022-46620", "field": "lastModified"}, {"timestamp": "2023-12-13T01:19:37.865Z", "date_only": false, "value": "2023-12-13T01:19:37.865451Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-46620", "record": "GSD-2022-46620", "field": "gsd.osvSchema.modified"}, {"timestamp": "2026-09-01T20:01:11.580Z", "date_only": false, "value": "2026-09-01T20:01:11.580363Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/84440", "record": "CVE-2022-46620", "field": "creation_timestamp", "uuid": "9b145887-b8b1-4a0d-b097-d1e364ab97dd", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page:  https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "url": "https://t.me/hacking_Attack/84440"}]}