CVE-2022-1344

Stored XSS due to no sanitization in the filename in causefx/organizr

State: Published
Severity: 9.0 Critical
Published: Apr 13, 2022
Updated: Aug 3, 2024
Reserved: Apr 13, 2022

Description

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

Scores

CVSS	Score	Vector	Source
3.0	9.0 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	@huntrdev

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
causefx/organizrcausefx	before 2.1.1810Affected

References

https://huntr.dev/bounties/35f66966-af13-4f07-9734-0c50fdfc3a8c
https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.