Reflected Cross-Site Scripting Vulnerability in Ice Hrm by Gamonoid
CVE-2022-25014

6.1MEDIUM

Key Information:

Vendor

Icehrm

Status
Icehrm
Vendor
CVE Published:
28 February 2022

What is CVE-2022-25014?

A reflected cross-site scripting (XSS) vulnerability was found in Ice Hrm, where the 'm' parameter in the user Dashboard can be exploited. By crafting a malicious link, attackers could trick users into clicking on it, potentially compromising their session credentials. This highlights the importance of stringent input validation and user awareness to mitigate such threats.

References

https://github.com/gamonoid/icehrm/issues/283
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.