CVE-2022-23961
Published: April 11, 2026· Updated: May 8, 2026
Official Description
In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface.
Risk Analysis
This vulnerability in Thruk Monitoring allows an unauthenticated remote attacker to inject malicious scripts into the login form, which are then executed when other users view the affected page. With a CVSS score of 6.1, this medium severity flaw is urgent because it is confirmed to be actively exploited.
Active exploitation of this vulnerability has been observed in the wild. The flaw is remotely exploitable without authentication, requiring user interaction.
Upgrade Thruk Monitoring to a version beyond 2.46.3 to address this reflected XSS vulnerability. Implement strong web application security practices to prevent similar injection attacks.
Technical Analysis
CVE-2022-23961 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CISA has added CVE-2022-23961 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (3)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-23961 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1