CVE-2022-44947
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.
Risk Assessment
The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. All users viewing modified records are potentially affected.
Recommendation
Immediately update Rukovoditel to the latest version and apply input filtering on the Note field. Additionally, implement a Content Security Policy (CSP).
Original NVD description (English source)
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".