← Voltar para CVEs

CVE-2022-48177

MEDIUM

5.4

Descricao

X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado4/15/2023

Ultima modificacao1/30/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

x2engine:x2crm

Fraquezas (CWE)

CWE-79CWE-79

Referencias

http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html(cve@mitre.org)

https://sourceforge.net/projects/x2engine/(cve@mitre.org)

http://packetstormsecurity.com/files/171792/X2CRM-6.6-6.9-Cross-Site-Scripting.html(af854a3a-2127-422b-91ae-364da2661108)

https://sourceforge.net/projects/x2engine/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.