CVE-2022-44952
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the application configuration module. An attacker can inject malicious JavaScript or HTML into the Copyright Text field, which executes upon saving.
Risk Assessment
The risk involves arbitrary script execution in administrators' browsers, potentially leading to session theft, account takeover, or malware distribution within the organization.
Recommendation
Immediately update Rukovoditel to the latest version and implement input filtering and encoding for the Copyright Text field. Additionally, restrict administrative panel access to trusted users only.
Other vulnerabilities in Rukovoditel
See all- CVE-2022-44945Critical
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-44951Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.
- CVE-2022-44950Medium
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
- CVE-2022-44949Medium
Rukovoditel v3.2.1 contains a stored XSS vulnerability in the Add New Field function. Attackers can inject malicious JavaScript or HTML into the Short Name field, leading to script execution in other users' browsers.
- CVE-2022-44948Medium
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Entities Group feature. Attackers can inject malicious JavaScript or HTML into the Name field, leading to script execution in other users' browsers.
- CVE-2022-44947Medium
Rukovoditel v3.2.1 contains a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature. An attacker can inject malicious JavaScript or HTML into the Note field, leading to script execution in the victim's browser.
- CVE-2022-44946Medium
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.
- CVE-2022-44944Medium
Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Announcement function. Attackers can inject arbitrary JavaScript or HTML into the Title field, leading to script execution in other users' browsers.
- CVE-2020-21732Medium
Rukovoditel Project Management app version 2.6 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can inject JavaScript code into the filename.
Original NVD description (English source)
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".
Vulnerability data from NVD (NIST) · CISA KEV · EPSS