PT-2022-28004 · Websoft · Websoft Hcm

Published 2022-12-12 · Updated 2025-04-22 · CVE-2022-46905

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WebSoft HCM version 2021.2.3.327

Description Insufficient processing of user input in WebSoft HCM allows an unauthenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS.

Recommendations For version 2021.2.3.327, update to a version that properly processes user input to prevent the injection of arbitrary HTML tags. As a temporary workaround, consider restricting user input to prevent the injection of malicious scripts until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46905

Affected Products

Websoft Hcm

References · 6

• https://news.websoft.ru/_wt/wiki_base/7175852393019676262 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46905 · Security Note
• https://t.me/cvenotify/119428 · Telegram Post
• https://t.me/cibsecurity/54364 · Telegram Post
• https://t.me/cvenotify/39937 · Telegram Post