CVE-2022-2839: vulnerability in Zephyr Project Manager
Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
Affected products
Unknown · Zephyr Project ManagerRelated CVEs — Zephyr Project Manager
In the same product, most dangerous first.