CVE-2022-43185
published 2022-10-19CVE-2022-43185: A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EXPLOIT
EPSS
0.96%
57.1th percentile
A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rukovoditel | rukovoditel | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Rukovoditel <= 3.2.1 - Cross-Site Scripting
nuclei·CVSS 5.4
CVE-2022-43185 [MEDIUM] Rukovoditel <= 3.2.1 - Cross-Site Scripting
Rukovoditel alert(document.domain)")'
- 'contains(body_3, "rukovoditel")'
condition: and
extractors:
- type: regex
name: nonce
group: 1
regex:
- 'id="form_session_token" value="(.*)" type="hidden"'
internal: true
# digest: 4b0a00483046022100ad91315d2fd4a807da2aa1d8ba70ab403a205eae8004af4f02bd1aea27941f29022100bd244578b81def8231be7dd67c53a6547124cf23f7bddf0dfb625837ebc83229:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2022-10-19
Published