TI-2022-10356 Aliases CVE-2022-27237 GHSA-4qj7-6xgq-rgvw

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component…

LOW 28CWE-79Published 2022-04-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

Why it matters now

EPSS 0.00562 46th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:ni:flexlogger:2021:r2::::::	2021 r2	Vulnerable	NI
cpe:2.3:a:ni:flexlogger:2021:r3::::::	2021 r3	Vulnerable	NI
cpe:2.3:a:ni:flexlogger:2021:r4::::::	2021 r4	Vulnerable	NI
cpe:2.3:a:ni:g_web_development_software:2021::::-:::	2021	Vulnerable	NI
cpe:2.3:a:ni:g_web_development_software:2021::::community:::	2021	Vulnerable	NI
cpe:2.3:a:ni:labview:2021:-:::-:::*	2021	Vulnerable	NI
cpe:2.3:a:ni:labview:2021:-:::community:::*	2021	Vulnerable	NI
cpe:2.3:a:ni:static_test_software_suite::::::::	before 1.2	Vulnerable	NI
cpe:2.3:a:ni:systemlink:2020:r4::::::	2020 r4	Vulnerable	NI
cpe:2.3:a:ni:systemlink:2022:r1::::::	2022 r1	Vulnerable	NI

cpe:2.3:a:ni:flexlogger:2021:r2:*:*:*:*:*:* Versions 2021 r2 Vulnerable ·NI
cpe:2.3:a:ni:flexlogger:2021:r3:*:*:*:*:*:* Versions 2021 r3 Vulnerable ·NI
cpe:2.3:a:ni:flexlogger:2021:r4:*:*:*:*:*:* Versions 2021 r4 Vulnerable ·NI
cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:-:*:*:* Versions 2021 Vulnerable ·NI
cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:community:*:*:* Versions 2021 Vulnerable ·NI
cpe:2.3:a:ni:labview:2021:-:*:*:-:*:*:* Versions 2021 Vulnerable ·NI
cpe:2.3:a:ni:labview:2021:-:*:*:community:*:*:* Versions 2021 Vulnerable ·NI
cpe:2.3:a:ni:static_test_software_suite:*:*:*:*:*:*:*:* Versions before 1.2 Vulnerable ·NI
cpe:2.3:a:ni:systemlink:2020:r4:*:*:*:*:*:* Versions 2020 r4 Vulnerable ·NI
cpe:2.3:a:ni:systemlink:2022:r1:*:*:*:*:*:* Versions 2022 r1 Vulnerable ·NI

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:ni:systemlink:2022:r2::::::	2022 r2	Vulnerable	NI

cpe:2.3:a:ni:systemlink:2022:r2:*:*:*:*:*:* Versions 2022 r2 Vulnerable ·NI

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-27237
2026-10-03 Alias added: GHSA-4qj7-6xgq-rgvw

References

Patch 1

https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html

TI-2025-02142 Path traversal in NI FlexLogger CVSS 3.1HIGH 8.8
TI-2024-05673 Incorrect Default Directory Permissions for NI SystemLink Redis Service CVSS 3.1MEDIUM 5.5
TI-2024-05672 NI SystemLink Server Ships Out of Date Redis Version CVSS 3.1HIGH 7.8
TI-2023-04724 Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences