PT-2022-7193 · Unknown · Rukovoditel

Published 2022-10-19 · Updated 2022-10-20 · CVE-2022-43185

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1

Description A stored cross-site scripting (XSS) issue in the Configuration/Holidays module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter. This can be exploited by a remote attacker to conduct a cross-site scripting attack.

Recommendations For Rukovoditel version 3.2.1, consider disabling the Configuration/Holidays module until a patch is available to prevent exploitation of the stored XSS vulnerability. Avoid using the Name parameter in the affected module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08997

CVE-2022-43185

Affected Products

Rukovoditel

References · 6

• 🔥 https://github.com/Kubozz/rukovoditel-3.2.1/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-43185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43185 · Security Note
• https://bdu.fstec.ru/vul/2023-08997 · Security Note
• https://t.me/cibsecurity/51785 · Telegram Post
• https://vuldb.com/es/?id.211895 · Note