CVE-2022-44952

Deeper analysis

Rukovoditel version 3.2.1 contains a stored cross-site scripting vulnerability in the configuration/application module at /index.php?module=configuration/application. The flaw, tracked as CWE-79, permits injection of arbitrary web scripts or HTML through the Copyright Text field when an authenticated user clicks "Add" and submits a crafted payload. The issue carries a CVSS 3.1 score of 5.4, reflecting network attack vector, low attack complexity, low privileges required, and required user interaction with changed scope.

An attacker with the ability to modify application configuration settings can store a malicious payload that executes in the browser of any subsequent user who views the affected page. Successful exploitation enables theft of session tokens, redirection to malicious sites, or other client-side actions within the context of the victim's session.

The EPSS score for this CVE rose from a low baseline to a peak of 0.0866 on 2025-01-22 before receding to the current value of 0.0176, indicating a period of increased exploitation interest after disclosure. Public references consist of the vendor site and an issue tracker entry but contain no explicit mitigation guidance.