CVE-2022-36180

CriticalCVSS 9.6

Published: 22/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.88%

55th percentile - higher than 55% of all known CVEs

Summary

Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via URL parameters. An attacker can inject malicious script through the message and plug parameters in several application paths.

Risk Assessment

The risk involves execution of arbitrary JavaScript in the administrator's browser, potentially leading to session theft, account takeover, or data leakage.

Recommendation

Immediately update Fusiondirectory to the latest version containing XSS fixes. Additionally implement input filtering and output encoding for URL parameters.

Original NVD description (English source)

Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.