CVE-2022-43164

Deeper analysis

CVE-2022-43164 is a stored cross-site scripting vulnerability in Rukovoditel version 3.2.1. It resides in the Global Lists feature at the endpoint /index.php?module=global_lists/lists and is triggered when an authenticated user adds a new list entry. The flaw stems from insufficient sanitization of the Name parameter, allowing an attacker to supply a crafted payload that is later rendered as executable script or HTML for other users.

An authenticated attacker with low privileges can exploit the issue by submitting malicious content through the Add action. Successful injection results in arbitrary script execution in the context of other users' sessions, enabling actions such as session hijacking or limited data manipulation within the application. The CVSS 5.4 score reflects the need for user interaction and the scoped impact on confidentiality and integrity.

The associated EPSS score remains flat at 0.0597 with no material increase after disclosure. No public advisories or vendor patches are referenced in the supplied sources.