PT-2022-24957 · Tasklists · Tasklists

Tsmr · Published 2022-11-10 · Updated 2022-11-11 · CVE-2022-39398

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions tasklists versions prior to 2.0.3

Description The issue allows for Cross-site Scripting (XSS) where an attacker can create XSS in task content when adding it. There are no known workarounds for this issue.

Recommendations For versions prior to 2.0.3, update to version 2.0.3 to resolve the issue. As a temporary workaround, consider restricting the ability to add task content to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-39398

GHSA-3QV3-8393-777Q

Affected Products

Tasklists

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39398.json · Exploit
• https://github.com/InfotelGLPI/tasklists/commit/4a1b30f3d9fa764695f98ce011c8542772530d47 · Patch
• https://osv.dev/vulnerability/CVE-2022-39398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39398 · Security Note
• https://github.com/InfotelGLPI/tasklists/security/advisories/GHSA-3qv3-8393-777q · Note
• https://t.me/cvenotify/37479 · Telegram Post