CVE-2022-1346

Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

CVSS v3 9.0 CRITICAL
CVSS v2.0 3.5 LOW

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a	Patch Third Party Advisory
https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*

History

25 Jul 2022, 10:17

Type	Values Removed	Values Added
CPE	cpe:2.3:a:organizr_project:organizr::::::::	cpe:2.3:a:organizr:organizr::::::::

22 Apr 2022, 13:01

Type	Values Removed	Values Added
CVSS	v2 : ~~6.0~~ v3 : ~~9.0~~	v2 : 3.5 v3 : 9.0

21 Apr 2022, 01:37

Type	Values Removed	Values Added
References	~~(CONFIRM) https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f -~~	(CONFIRM) https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f - Exploit, Patch, Third Party Advisory
References	~~(MISC) https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a -~~	(MISC) https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a - Patch, Third Party Advisory
CPE		cpe:2.3:a:organizr_project:organizr::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.0 v3 : 9.0

13 Apr 2022, 18:55

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-04-13 18:15

Updated : 2024-02-04 22:29

NVD link : CVE-2022-1346

Mitre link : CVE-2022-1346

CVE.ORG link : CVE-2022-1346

JSON object : View

Products Affected

organizr

organizr

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-1346", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2022-04-13T18:15:10.007", "references": [{"url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a", "tags": ["Patch", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.dev/bounties/8fe435b0-192f-41ca-b41e-580fcd34892f", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo XSS almacenados en el repositorio de GitHub causefx/organizr versiones anteriores a 2.1.1810. Esto permite a atacantes ejecutar scripts maliciosos en el navegador del usuario y puede conllevar a un secuestro de sesi\u00f3n, exposici\u00f3n de datos confidenciales y cosas peores"}], "lastModified": "2022-07-25T10:17:03.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "459885EC-2A73-4FB7-947B-7185FE93F496", "versionEndExcluding": "2.1.1810"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}