CVE-2022-2035

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-09 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.

Affected products

Rustici Software SCORM Engine: before 20.1.45.914; from 21.1.1 before 21.1.7.219 — fixed in 20.1.45.914, 21.1.7.219

How to fix

Upgrade to a fixed version: Rustici Software SCORM Engine 20.1.45.914, 21.1.7.219. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2035 or the next vulnerability affects your stack