CVE-2022-2885 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

2022-08-2108:05:09

CWE-79

@huntrdev

www.cve.org

cross-site scripting

stored

github

yetiforcecompany

yetiforcecrm

prior to 6.4.0

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

EPSS

0.001

Percentile

21.4%

JSON

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

CNA Affected

[
  {
    "product": "yetiforcecompany/yetiforcecrm",
    "vendor": "yetiforcecompany",
    "versions": [
      {
        "lessThan": "6.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]