CVE-2022-44952
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.
Risk Assessment
The risk involves arbitrary script execution in administrators' browsers, potentially leading to session theft, account takeover, or malware distribution within the organization.
Recommendation
Immediately update Rukovoditel to the latest version and implement input filtering and encoding for the Copyright Text field. Additionally, restrict administrative panel access to trusted users only.
Original NVD description (English source)
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".