Unauthorized session actions via stored rule script

Stored XSS in Threat Intelligence rules in Nozomi Networks Guardian and CMC before 22.6.2 allows remote authenticated users to inject script. The web management interface stores attacker-supplied JavaScript in Yara rule content without neutralizing it and executes the script when a legitimate user views the rule; packet and STYX rules permit limited HTML injection. Administrative access is required to create the rule, and exploitation depends on another authenticated user viewing it, enabling unauthorized actions in that session or access to sensitive information.