CVE-2022-26263

Deeper analysis

Yonyou u8 version 13.0 contains a DOM-based cross-site scripting vulnerability in the /u8sl/WebHelp component. The flaw is tracked as CVE-2022-26263 and is classified under CWE-79 with a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity impact.

An unauthenticated remote attacker can exploit the issue by supplying a crafted input that executes arbitrary script in the context of a victim user who interacts with the affected WebHelp page. Successful exploitation allows the attacker to read limited data from the victim's session or perform actions within the application's scope on the victim's behalf.

Public references consist primarily of the vendor domain and a GitHub repository containing a proof-of-concept description; none of the listed sources provide mitigation guidance, patch availability, or configuration recommendations. The associated EPSS score reached a peak of 0.1235 before receding to its current value of 0.0998, indicating a modest post-disclosure increase in observed exploitation interest that has since declined.