CVE-2022-44948

MediumCVSS 5.4

Published: 02/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.90%

56th percentile - higher than 56% of all known CVEs

Summary

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.

Risk Assessment

The risk includes session hijacking, admin account takeover, or displaying fraudulent content, potentially compromising data confidentiality and integrity within the organization.

Recommendation

Immediately update Rukovoditel to the latest version and implement input filtering and validation for the Name field to prevent script injection.

Original NVD description (English source)

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".