CVE-2022-1344 - Vulnerability Details - OpenCVE

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Organizr	Organizr

Configuration 1 [-]

cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-04-13T18:05:11

Updated: 2024-08-03T00:03:05.936Z

Reserved: 2022-04-13T00:00:00

Link: CVE-2022-1344

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-13T18:15:09.950

Modified: 2024-11-21T06:40:32.130

Link: CVE-2022-1344

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "causefx/organizr", "vendor": "causefx", "versions": [{"lessThan": "2.1.1810", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T18:05:11", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}], "source": {"advisory": "35f66966-af13-4f07-9734-0c50fdfc3a8c", "discovery": "EXTERNAL"}, "title": "Stored XSS due to no sanitization in the filename in causefx/organizr", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-1344", "STATE": "PUBLIC", "TITLE": "Stored XSS due to no sanitization in the filename in causefx/organizr"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "causefx/organizr", "version": {"version_data": [{"version_affected": "<", "version_value": "2.1.1810"}]}}]}, "vendor_name": "causefx"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c"}, {"name": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a", "refsource": "MISC", "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}]}, "source": {"advisory": "35f66966-af13-4f07-9734-0c50fdfc3a8c", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:03:05.936Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-1344", "datePublished": "2022-04-13T18:05:11", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2024-08-03T00:03:05.936Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*", "matchCriteriaId": "459885EC-2A73-4FB7-947B-7185FE93F496", "versionEndExcluding": "2.1.1810", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}, {"lang": "es", "value": "Una vulnerabilidad dd tipo XSS almacenado debido a una falta de saneo en el nombre de archivo en el repositorio de GitHub causefx/organizr versiones anteriores a 2.1.1810. Esto permite a atacantes ejecutar scripts maliciosos en el navegador del usuario y puede conllevar a un secuestro de sesi\u00f3n, exposici\u00f3n de datos confidenciales y cosas peores"}], "id": "CVE-2022-1344", "lastModified": "2024-11-21T06:40:32.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-13T18:15:09.950", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@huntr.dev", "type": "Secondary"}]}