CVE-2022-39172: Viva-Project Openviva

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process.

Affected products

• Viva-Project Openviva: before 2022-08-01 (fixed in 2022-08-01)

Published 2023-10-30. Last modified 2026-06-17.