Stored Cross-Site Scripting Vulnerability in Rukovoditel by Rukovoditel
CVE-2022-43167

5.4MEDIUM

Key Information:

Vendor

Rukovoditel

Status
Rukovoditel
Vendor
CVE Published:
28 October 2022

What is CVE-2022-43167?

A stored cross-site scripting (XSS) vulnerability exists in the Users Alerts feature of Rukovoditel, allowing authenticated users to inject malicious scripts. When a user adds an alert through the Title parameter, it can be exploited to execute arbitrary web scripts or HTML, posing significant risks to the application and its users. Mitigating this vulnerability is essential to maintaining secure web interactions.

References

https://github.com/anhdq201/rukovoditel/issues/7

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.