CVE-2022-37462

5.4 mediumEPSS 0.6%

Medium (5.4) in upstreamworks upstream works on finesse. EPSS 0.6% chance of exploitation in the next 30 days.

A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.0 allows remote attackers to inject arbitrary web script or HTML via AttachmentId in the file-upload details.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-04-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

upstreamworks:upstream_works_on_finesse

References

https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploits
https://www.upstreamworks.com/support/notifications/
https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploits
https://www.upstreamworks.com/support/notifications/

Check your stack JSON