CVE-2022-1346 - Vulnerability Details - OpenCVE

Description

Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

Published: 2022-04-13

Score: 9.0 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

causefx

causefx/organizr

affected

Version	Status	Constraints
`unspecified`	affected	< 2.1.1810

Configuration 1 [-]

cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-24668	Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00373.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f

History

No history.

Subscriptions

Organizr Organizr

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-04-13T18:10:12.000Z

Updated: 2024-08-03T00:03:05.823Z

Reserved: 2022-04-13T00:00:00.000Z

Link: CVE-2022-1346

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-13T18:15:10.007

Modified: 2024-11-21T06:40:32.387

Link: CVE-2022-1346

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "causefx/organizr", "vendor": "causefx", "versions": [{"lessThan": "2.1.1810", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T18:10:12.000Z", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f"}], "source": {"advisory": "8fe435b0-192f-41ca-b41e-580fcd34892f", "discovery": "EXTERNAL"}, "title": "Multiple Stored XSS in causefx/organizr", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-1346", "STATE": "PUBLIC", "TITLE": "Multiple Stored XSS in causefx/organizr"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "causefx/organizr", "version": {"version_data": [{"version_affected": "<", "version_value": "2.1.1810"}]}}]}, "vendor_name": "causefx"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a", "refsource": "MISC", "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"name": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f"}]}, "source": {"advisory": "8fe435b0-192f-41ca-b41e-580fcd34892f", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:03:05.823Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-1346", "datePublished": "2022-04-13T18:10:12.000Z", "dateReserved": "2022-04-13T00:00:00.000Z", "dateUpdated": "2024-08-03T00:03:05.823Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*", "matchCriteriaId": "459885EC-2A73-4FB7-947B-7185FE93F496", "versionEndExcluding": "2.1.1810", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo XSS almacenados en el repositorio de GitHub causefx/organizr versiones anteriores a 2.1.1810. Esto permite a atacantes ejecutar scripts maliciosos en el navegador del usuario y puede conllevar a un secuestro de sesi\u00f3n, exposici\u00f3n de datos confidenciales y cosas peores"}], "id": "CVE-2022-1346", "lastModified": "2024-11-21T06:40:32.387", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-13T18:15:10.007", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@huntr.dev", "type": "Secondary"}]}