CVE-2022-44629

2023-08-1010:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-44629

authentication

stored xss

catalyst connect

zoho crm

client portal

plugin

security vulnerability

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

14.1%

JSON

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.

Affected configurations

Vulners

NVD

Node

catalyst_connectcatalyst_connect_zoho_crm_client_portalRange≤2.0.0

CPENameOperatorVersion
catalystconnect:catalyst_connect_zoho_crm_client_portalcatalystconnect catalyst connect zoho crm client portallt2.1.0

CPE	Name	Operator	Version
catalystconnect:catalyst_connect_zoho_crm_client_portal	catalystconnect catalyst connect zoho crm client portal	lt	2.1.0

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "catalyst-connect-client-portal",
    "product": "Catalyst Connect Zoho CRM Client Portal",
    "vendor": "Catalyst Connect",
    "versions": [
      {
        "changes": [
          {
            "at": "2.1.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "2.0.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/catalyst-connect-client-portal/wordpress-catalyst-connect-zoho-crm-client-portal-plugin-2-0-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve