CVE-2022-22109: DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title

Published Jan 5, 2022

Updated

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.

Affected Software

1 affected component

Daybydaycrm Daybyday Crm=2.2.0

Remediation

Patch Available

https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2

Information

Update to 2.2.1

Event History

Jan 5, 2022

CVE Published

via MITRE·03:05 PM

Data Sourced

via MITRE·03:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-22109?

CVE-2022-22109 is classified as a medium severity vulnerability due to its potential for stored XSS attacks.

How do I fix CVE-2022-22109?

To fix CVE-2022-22109, upgrade Daybyday CRM to a version that addresses the XSS vulnerability.

What type of vulnerability is CVE-2022-22109?

CVE-2022-22109 is a Stored Cross-Site Scripting (XSS) vulnerability.

Who is impacted by CVE-2022-22109?

Low privileged application users of Daybyday CRM version 2.2.0 are impacted by CVE-2022-22109.

When was CVE-2022-22109 discovered?

CVE-2022-22109 was reported alongside the release of version 2.2.0 of Daybyday CRM.