CVE-2022-43166
Published: 28 October 2022
Summary
CVE-2022-43166 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Rukovoditel Rukovoditel. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-43166 is a stored cross-site scripting vulnerability in the Global Entities feature of Rukovoditel version 3.2.1. The flaw is located at the endpoint /index.php?module=entities/entities and can be triggered when an authenticated user clicks "Add New Entity" and supplies a crafted payload in the Name parameter, allowing arbitrary web scripts or HTML to be stored and later rendered.
An authenticated attacker with low privileges can exploit the issue to execute scripts in the browsers of other users who view the affected entity. The vulnerability carries a CVSS 3.1 score of 5.4 and maps to CWE-79, reflecting limited confidentiality and integrity impacts that require user interaction and occur across security contexts.
The associated EPSS score reached a modest peak of 0.0635 before receding to its current value of 0.0446, indicating no significant surge in observed exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-46212
Vulnerability details
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.