What’s Vulnerable › Vulnerabilities

CVE-2022-31358

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-14 · updated 2026-07-09
• Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.

Affected products

• Proxmox Virtual Environment: before 7.2-3 — fixed in 7.2-3

How to fix

Upgrade to a fixed version: Proxmox Virtual Environment 7.2-3. Check the vendor advisory for mitigations.

References

• https://git.proxmox.com/?p=pve-http-server.git;a=commitdiff;h=00661f1223b7c0afffa64e1d91f5e018b985f762
• https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
• https://www.proxmox.com/en/
• https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=00661f1223b7c0afffa64e1d91f5e018b985f762
• https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
• https://www.proxmox.com/en/

Get alerted when CVE-2022-31358 or the next vulnerability affects your stack