Riskcovery

CVE-2022-3333

Zephyr Project Manager REST Call cross site scripting

State
Published
Severity
3.5 Low
Published
Sep 28, 2022
Updated
Apr 15, 2025
Reserved
Sep 27, 2022

Read the record on cve.org

Description

A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NVulDB

Weaknesses

  • CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting

Affected Products

ProductVersions
Project ManagerZephyr
  • 3.2.0Affected
  • 3.2.1Affected
  • 3.2.2Affected
  • 3.2.3Affected
  • 3.2.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.