CVE-2022-43185

MEDIUMNuclei

Rukovoditel <= 3.2.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-43185 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMRukovoditel <= 3.2.1 - Cross-Site ScriptingCVSS 5.4

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".

Impact

Authenticated attackers can inject malicious JavaScript through the Name parameter in Global Lists that executes in other users' browsers when they view the stored content, potentially stealing session tokens or performing unauthorized actions in Rukovoditel project management system.

Remediation

Upgrade Rukovoditel to a version higher than 3.2.1 or apply the vendor-provided patch to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022rukovoditelstored-xssxssauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:rukovoditel:rukovoditel:3.2.1:*:*:*:*:*:*:*
Shodan: http.favicon.hash:-1499940355
FOFA: icon_hash=-1499940355
https://github.com/anhdq201/rukovoditel/issues/1 http://rukovoditel.com/ https://nvd.nist.gov/vuln/detail/CVE-2022-43185

Source: ProjectDiscovery

References

2