Stored Cross-Site Scripting Vulnerability in Rukovoditel by Rukovoditel
CVE-2022-43167
5.4MEDIUM
What is CVE-2022-43167?
A stored cross-site scripting (XSS) vulnerability exists in the Users Alerts feature of Rukovoditel, allowing authenticated users to inject malicious scripts. When a user adds an alert through the Title parameter, it can be exploited to execute arbitrary web scripts or HTML, posing significant risks to the application and its users. Mitigating this vulnerability is essential to maintaining secure web interactions.
References
EPSS Score
7% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved