CVE-2022-36783: Algosec Fireflow

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user.

Affected products

• Algosec Fireflow: from a32.0, before a32.0.580-277 (fixed in a32.0.580-277); from a32.10, before a32.10.410-212 (fixed in a32.10.410-212); from a32.20, before a32.20.230-35 (fixed in a32.20.230-35)

Published 2022-10-25. Last modified 2026-06-17.