Stored Cross-Site Scripting Vulnerability in Rukovoditel by Rukovoditel
CVE-2022-43169

5.4MEDIUM

Key Information:

Vendor: Rukovoditel
Status: Rukovoditel
Vendor: CVE Published:; 28 October 2022

🔔 Create Rukovoditel Vulnerability Alert

What is CVE-2022-43169?

A stored cross-site scripting vulnerability has been identified in the Users Access Groups feature of Rukovoditel version 3.2.1. This flaw allows authenticated attackers to inject arbitrary web scripts or HTML through a specially crafted payload targeting the Name parameter when adding a new group. If exploited, this vulnerability can lead to unauthorized actions and access, posing risks to sensitive data and user accounts.

References

https://github.com/anhdq201/rukovoditel/issues/3

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 28, 2022
Vulnerability Reserved
Oct 17, 2022

CVE-2022-43169 Data

JSON