PT-2022-18778 · Seeddms · Seeddms

Uwe Steinmann · Published 2022-06-06 · Updated 2022-06-13 · CVE-2022-28051

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS versions 5.1.25 through 6.0.18

Description The issue affects the "Add category" functionality inside the "Global Keywords" menu, allowing an attacker to inject malicious javascript code through stored XSS.

Recommendations For versions 5.1.25 through 6.0.18, consider disabling the "Add category" functionality until a patch is available to prevent exploitation. Restrict access to the "Global Keywords" menu to minimize the risk of stored XSS attacks. Avoid using the "Add category" feature in the affected versions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28051

Affected Products

Seeddms

References · 7

• 🔥 https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/blob/main/CVE-2022-28051/README.md · Exploit
• 🔥 https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28051 · Exploit
• https://sourceforge.net/p/seeddms/code/ci/6fc17be5d95e8f00fbe5c124c4acd377fa2ce69d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-28051 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28051 · Vendor Advisory
• https://t.me/cibsecurity/43905 · Telegram Post
• https://t.me/cvenotify/31190 · Telegram Post