CVE-2022-1347 - Vulnerability Details - OpenCVE

Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Organizr	Organizr

Configuration 1 [-]

cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntrdev

Published: 2022-04-13T18:20:12

Updated: 2024-08-03T00:03:05.862Z

Reserved: 2022-04-13T00:00:00

Link: CVE-2022-1347

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-13T19:15:09.187

Modified: 2024-11-21T06:40:32.513

Link: CVE-2022-1347

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "causefx/organizr", "vendor": "causefx", "versions": [{"lessThan": "2.1.1810", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS in the \"Username\" & \"Email\" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation"}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T18:20:12", "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf"}], "source": {"advisory": "6059501f-05d2-4e76-ae03-5eb64835e6bf", "discovery": "EXTERNAL"}, "title": "Stored XSS in the \"Username\" & \"Email\" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@huntr.dev", "ID": "CVE-2022-1347", "STATE": "PUBLIC", "TITLE": "Stored XSS in the \"Username\" & \"Email\" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "causefx/organizr", "version": {"version_data": [{"version_affected": "<", "version_value": "2.1.1810"}]}}]}, "vendor_name": "causefx"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored XSS in the \"Username\" & \"Email\" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation"}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a", "refsource": "MISC", "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"name": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf", "refsource": "CONFIRM", "url": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf"}]}, "source": {"advisory": "6059501f-05d2-4e76-ae03-5eb64835e6bf", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:03:05.862Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf"}]}]}, "cveMetadata": {"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "cveId": "CVE-2022-1347", "datePublished": "2022-04-13T18:20:12", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2024-08-03T00:03:05.862Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:organizr:organizr:*:*:*:*:*:*:*:*", "matchCriteriaId": "459885EC-2A73-4FB7-947B-7185FE93F496", "versionEndExcluding": "2.1.1810", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Stored XSS in the \"Username\" & \"Email\" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation"}, {"lang": "es", "value": "Una vulnerabilidad de tipo XSS almacenado en los campos de entrada \"Username\" y \"Email\" conlleva a una toma de posesi\u00f3n de la cuenta de los usuarios administradores y coadministradores en el repositorio de GitHub causefx/organizr versiones anteriores a 2.1.1810. Una adquisici\u00f3n de cuentas y escalada de privilegios"}], "id": "CVE-2022-1347", "lastModified": "2024-11-21T06:40:32.513", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-13T19:15:09.187", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}