VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.
CVE-2022-34879

6.5MEDIUM

Key Information:

Vendor: Vicidial
Status: Vicidial
Vendor: CVE Published:; 5 July 2022

What is CVE-2022-34879?

Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.

Affected Version(s)

VICIdial 2.14b0.5 < 3555

References

https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&...

x_refsource_CONFIRM

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 5, 2022
Vulnerability Reserved
Jun 30, 2022

Credit

h00die for discovery, disclosure, and exploit. Matt Florell with VICIdial for patching the software.