PT-2022-22498 · Unknown · Human Resource Management System

Draco · Published 2022-10-14 · Updated 2024-01-25 · CVE-2022-3502

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Human Resource Management System version 1.0

Description A problematic issue has been found in the Human Resource Management System, affecting an unknown part of the Leave Handler component. The manipulation of the Reason argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Human Resource Management System version 1.0, consider disabling the Leave Handler component or restricting access to it until a patch is available. As a temporary workaround, avoid using the Reason argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-3502

Affected Products

Human Resource Management System

References · 5

• 🔥 https://github.com/draco1725/POC/blob/main/Exploit/Stored%20Xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3502 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3502 · Vendor Advisory
• https://vuldb.com/?id.210831 · Note
• https://t.me/cibsecurity/51394 · Telegram Post