PT-2022-19052 · Seeddms · Seeddms

Loociprian · Published 2022-06-06 · Updated 2022-06-14 · CVE-2022-28479

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS versions 6.0.18 and 5.1.25 and below

Description The issue allows an attacker with admin privileges to inject a payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu, resulting in stored XSS.

Recommendations For SeedDMS versions 6.0.18 and below, and 5.1.25 and below, consider disabling access to the "Role management" and "Users management" menus until a patch is available. As a temporary workaround, restrict the use of admin privileges to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-28479

Affected Products

Seeddms

References · 7

• 🔥 https://github.com/looCiprian/Responsible-Vulnerability-Disclosure/tree/main/CVE-2022-28479 · Exploit
• https://sourceforge.net/p/seeddms/code/ci/9e92524fdbd1e7c3e6771d669f140c62389ec375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28479 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28479 · Vendor Advisory
• https://t.me/cvenotify/31188 · Telegram Post
• https://t.me/cibsecurity/43898 · Telegram Post
• https://t.me/cvenotify/31213 · Telegram Post