CVE-2022-43167

Deeper analysis

CVE-2022-43167 is a stored cross-site scripting vulnerability in Rukovoditel version 3.2.1. It resides in the Users Alerts feature at the endpoint /index.php?module=users_alerts/users_alerts and is triggered when an authenticated user adds an alert whose Title parameter contains a crafted payload. The flaw is tracked as CWE-79 and carries a CVSS 3.1 score of 5.4.

An authenticated attacker with low privileges can inject arbitrary JavaScript or HTML into the Title field. Once saved, the malicious content is stored and later rendered for other users who view the alert, enabling session hijacking, privilege escalation within the application, or other client-side actions that respect the same-origin policy of the affected instance.

The two supplied references point only to a public GitHub issue that describes the finding; they contain no official vendor advisory, patch details, or mitigation guidance. The associated EPSS score remains low, with a current value of 0.0592 and a peak of 0.0707, indicating limited observed exploitation interest since disclosure.