CVE-2022-22112: DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)
In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22112?
CVE-2022-22112 has a low severity rating due to its client-side impact but can lead to JavaScript execution in the user's browser.
How do I fix CVE-2022-22112?
To fix CVE-2022-22112, update DayByDay CRM to version 2.2.2 or later where the vulnerability is addressed.
What versions of DayByDay CRM are affected by CVE-2022-22112?
CVE-2022-22112 affects DayByDay CRM versions from 1.1 to 2.2.1.
What type of attack is associated with CVE-2022-22112?
CVE-2022-22112 is associated with client-side template injection attacks.
Can a low privileged user exploit CVE-2022-22112?
Yes, a low privileged attacker can exploit CVE-2022-22112 by injecting template payloads into the application.