Stored Cross-Site Scripting Vulnerability in Rukovoditel by Rukovoditel
CVE-2022-44952

5.4MEDIUM

Key Information:

Vendor

Rukovoditel

Status
Rukovoditel
Vendor
CVE Published:
2 December 2022

What is CVE-2022-44952?

Rukovoditel v3.2.1 contains a stored cross-site scripting vulnerability located in the /index.php?module=configuration/application endpoint. This flaw allows unauthorized users to inject arbitrary web scripts or HTML through the Copyright Text field by submitting a specially crafted payload after selecting 'Add'. Successful exploitation of this vulnerability can lead to the execution of malicious scripts in users' browsers, potentially compromising their data and security.

References

http://rukovoditel.com
https://github.com/anhdq201/rukovoditel/issues/9

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.