PT-2023-15602 · Unknown · X2Crm Open Source Sales Crm

CVE-2022-48177 · Publicado 2023-04-15 · Atualizado 2026-01-30

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions X2CRM Open Source Sales CRM versions 6.6 through 6.9

Description A reflected cross-site scripting (XSS) issue was discovered in X2CRM Open Source Sales CRM. This issue allows attackers to create malicious JavaScript that will be executed by the victim user's browser via the model parameter in the adin/importModels Import Records Model field.

Recommendations For versions 6.6 and 6.9, consider restricting access to the adin/importModels Import Records Model field until a patch is available. As a temporary workaround, avoid using the model parameter in the affected Import Records Model field to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-48177

Produtos afetados

X2Crm Open Source Sales Crm

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48177.json · Exploit
• 🔥 http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/51346 · Exploit
• https://t.me/cvenotify/48301 · Publicação no Telegram
• https://t.me/cveNotify/150418 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-48177 · Aviso do Fabricante
• https://t.me/cibsecurity/62210 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-48177 · Nota de Segurança
• https://sourceforge.net/projects/x2engine · Nota