CVE-2022-48326

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48326
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 Exploit Vendor Advisory
https://github.com/RamonSilva20/mapos/issues/2010 Exploit Issue Tracking Vendor Advisory
https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 Patch Vendor Advisory
https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 Exploit Vendor Advisory
https://github.com/RamonSilva20/mapos/issues/2010 Exploit Issue Tracking Vendor Advisory
https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:*
History

21 Nov 2024, 07:33

Type Values Removed Values Added
References () https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - Exploit, Vendor Advisory () https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - Exploit, Vendor Advisory
References () https://github.com/RamonSilva20/mapos/issues/2010 - Exploit, Issue Tracking, Vendor Advisory () https://github.com/RamonSilva20/mapos/issues/2010 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 - Patch, Vendor Advisory () https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 - Patch, Vendor Advisory

27 Feb 2023, 16:41

Type Values Removed Values Added
References (MISC) https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 - (MISC) https://github.com/RamonSilva20/mapos/pull/2015#pullrequestreview-1271395780 - Patch, Vendor Advisory
References (MISC) https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - (MISC) https://gist.github.com/enferas/7c7f0a3c6cb30939d9039043c0b86ea8 - Exploit, Vendor Advisory
References (MISC) https://github.com/RamonSilva20/mapos/issues/2010 - (MISC) https://github.com/RamonSilva20/mapos/issues/2010 - Exploit, Issue Tracking, Vendor Advisory
CPE cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1
CWE CWE-79

17 Feb 2023, 12:52

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-16 21:15

Updated : 2025-03-19 15:15

NVD link : CVE-2022-48326

Mitre link : CVE-2022-48326

CVE.ORG link : CVE-2022-48326

JSON object : View

Products Affected

mapos

  • map-os
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')