CVE-2022-22112mediumCWE-79

CVE-2022-22112: falha de média gravidade em Bottelet DaybydayCRM

DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DaybydayCRM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.6%
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Bottelet · DaybydayCRM
CVEs relacionadas — Bottelet DaybydayCRM

No mesmo produto, das mais perigosas para as menos.

CVE-2022-22110HIGHDayByDay CRM - Weak Password Requirements in Update UserEPSS 1.2%CVE-2022-22113HIGHDayByDay CRM - Insufficient Session Expiration after Password ChangeEPSS 1.1%CVE-2022-22111HIGHDayByDay CRM - Missing Authorization when Changing PasswordEPSS 1.0%CVE-2022-22108MEDIUMDayByDay CRM - Missing Authorization when Viewing AbsencesEPSS 0.7%CVE-2022-22107MEDIUMDayByDay CRM - Missing Authorization when Viewing AppointmentsEPSS 0.7%CVE-2022-22109MEDIUMDayByDay CRM - Stored Cross-Site Scripting (XSS) in Task TitleEPSS 0.5%