CVE-2022-43169

Deeper analysis

A stored cross-site scripting vulnerability affects the Users Access Groups feature in Rukovoditel version 3.2.1. The flaw resides at the endpoint /index.php?module=users_groups/users_groups and is triggered when an authenticated user adds a new group; the application fails to sanitize the Name parameter, permitting a crafted payload to be stored and later rendered as executable script or HTML.

An attacker with a low-privileged authenticated account can exploit the issue by submitting malicious input through the Add New Group dialog. Successful injection allows execution of arbitrary web scripts in the context of other users who view the affected group listing, resulting in limited impacts to confidentiality and integrity without affecting availability.

The two referenced GitHub issues document the discovery but contain no vendor advisory, patch details, or mitigation guidance. The associated EPSS score reached a peak of 0.0928 after disclosure before settling at 0.0733, indicating modest post-publication interest that remains at a low absolute level.