Read the docs
TI-2022-01177 Aliases CVE-2022-1293GHSA-85mj-gq7p-m95w

XSS vulnerability in Citadel

Priority LOW 28CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-80.

Summary

The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.

Why it matters now

EPSS 0.00489 42nd percentileScored 2026-11-07
Fix Fixed Citadel Web Client (Thales): 7.1.2Citadel Macosx Desktop Client (Thales): 7.1.2+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ThalesCitadel Web Client7.1.1 to before 7.1.27.1.2Patch availableCNA
ThalesCitadel Macosx Desktop Client7.1.1 to before 7.1.27.1.2Patch availableCNA
ThalesCitadel Windows Desktop Client7.1.1 to before 7.1.27.1.2Patch availableCNA
  • Citadel Web Client VendorThales Affected 7.1.1 to before 7.1.2 Fixed in 7.1.2 Patch available CNA
  • Citadel Macosx Desktop Client VendorThales Affected 7.1.1 to before 7.1.2 Fixed in 7.1.2 Patch available CNA
  • Citadel Windows Desktop Client VendorThales Affected 7.1.1 to before 7.1.2 Fixed in 7.1.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:thalesgroup:citadel:*:*:*:*:*:*:*:*before 7.1.2VulnerableThales
  • cpe:2.3:a:thalesgroup:citadel:*:*:*:*:*:*:*:* Versions before 7.1.2 Vulnerable ·Thales

Remediation

  • Fix · CNA Citadel Web Client (Thales) Fixed in 7.1.2
  • Fix · CNA Citadel Macosx Desktop Client (Thales) Fixed in 7.1.2
  • Fix · CNA Citadel Windows Desktop Client (Thales) Fixed in 7.1.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1293
  2. 2026-10-03 Alias added: GHSA-85mj-gq7p-m95w

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences