PT-2022-15245 · Unknown · Daybyday Crm

Published 2022-01-05 · Updated 2022-01-08 · CVE-2022-22109

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Daybyday CRM version 2.2.0

Description The issue allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim's browser when they open the "/tasks" page to view all the tasks. This is a Stored Cross-Site Scripting (XSS) issue.

Recommendations For Daybyday CRM version 2.2.0, consider disabling the ability to input scripts in the title field of new tasks until a patch is available. Restrict access to the "/tasks" page to minimize the risk of exploitation. Avoid using the title field in the affected task creation functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22109

GHSA-JR37-66PJ-36V7

Affected Products

Daybyday Crm

References · 7

• https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-22109 · Security Note
• https://osv.dev/vulnerability/GHSA-jr37-66pj-36v7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22109 · Vendor Advisory
• https://github.com/Bottelet/DaybydayCRM · Note
• https://t.me/cibsecurity/34987 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22109 · Note