CVE-2022-44957
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /clients/listclients.php. Attackers can inject arbitrary JavaScript or HTML into the Name field, leading to script execution in the victim's browser.
Risk Assessment
The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data through arbitrary code execution in the victim's browser context.
Recommendation
Update webtareas to the latest patched version and implement input filtering and encoding for the Name field.
Other vulnerabilities in webtareas
See all- CVE-2022-44291Critical
A SQL injection vulnerability was discovered in webTareas 2.4p5 in the phasesets.php file via the id parameter. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2022-44290Critical
A SQL injection vulnerability was discovered in webTareas 2.4p5 in the deleteapprovalstages.php file via the id parameter. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-44962Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /calendar/viewcalendar.php. This flaw allows an attacker to inject arbitrary web scripts or HTML via the Subject field.
- CVE-2022-44961Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /forums/editforum.php. It allows an attacker to inject arbitrary web scripts or HTML via the Name field.
- CVE-2022-44960Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /general/search.php?searchtype=simple. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the Search field.
- CVE-2022-44959Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /meetings/listmeetings.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
- CVE-2022-44956Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /projects/listprojects.php. Attackers can inject arbitrary web scripts or HTML via the Name field, leading to script execution in the victim's browser.
- CVE-2022-44955Medium
A cross-site scripting (XSS) vulnerability was discovered in the Chat function of webtareas 2.4p5. This flaw allows attackers to inject arbitrary web scripts or HTML via the Messages field.
- CVE-2022-44954Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the /contacts/listcontacts.php component. Attackers can inject arbitrary web scripts or HTML via the Last Name field when adding a contact.
- CVE-2022-44953Medium
A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /linkedcontent/listfiles.php. Attackers can inject arbitrary web scripts or HTML into the Name field after clicking 'Add'.
Original NVD description (English source)
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS