PT-2022-15251 · Teedy · Teedy

Published 2022-01-10 · Updated 2022-01-21 · CVE-2022-22114

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Teedy versions v1.5 through v1.9

Description The issue concerns Reflected Cross-Site Scripting (XSS) in the "search term" search functionality, which is not sufficiently sanitized, allowing the injection of arbitrary scripts. These scripts are executed in a victim's browser when they enter a crafted URL. In severe cases, the victim could be a highly privileged administrator, and the injected scripts can extract the Session ID, leading to full Account Takeover by an unauthenticated attacker.

Recommendations For versions v1.5 through v1.9, consider disabling the search functionality temporarily until a patch is available to prevent the injection of arbitrary scripts. Restrict access to the search results page to minimize the risk of exploitation. Avoid using the search term functionality in the affected versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22114

Affected Products

Teedy

References · 5

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22114 · Exploit
• https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-22114 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22114 · Vendor Advisory
• https://t.me/cibsecurity/35192 · Telegram Post