CVE-2022-44949
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.
Risk Assessment
The risk includes session hijacking, admin account takeover, or malware distribution within the organization via the injected script.
Recommendation
Update Rukovoditel to the latest version immediately and implement input filtering and encoding for the Short Name field.
Original NVD description (English source)
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.