CVE-2022-48325: XSS
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2) oldSenha, (3) novaSenha, (4) termo, (5) nome, (6) cnpj, (7) ie, (8) cep, (9) logradouro, (10) numero, (11) bairro, (12) cidade, (13) uf, (14) telefone, (15) email, (16) id, (17) appname, (18) perpage, (19) apptheme, (20) osnotification, (21) emailautomatico, (22) controlestoque, (23) notificawhats, (24) controlbaixa, (25) controleditos, (26) controleditvendas, (27) controldatatable, (28) pixkey, (29) osstatuslist, (30) control2vias, (31) status, (32) start, (33) end in file application/controllers/Mapos.php; (34) token, (35) senha, (36) email, (37) nomeCliente, (38) documento, (39) telefone, (40) celular, (41) rua, (42) numero, (43) complemento, (44) bairro, (45) cidade, (46) estado, (47) cep, (48) idClientes, (49) descricaoProduto, (50) defeito in file application/controllers/Mine.php; (51) pesquisa, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantiasid, (59) clientesid, (60) usuariosid, (61) idOs, (62) garantia, (63) descricaoProduto, (64) defeito, (65) observacoes, (66) laudoTecnico, (67) id, (68) preco, (69) quantidade, (70) idProduto, (71) idOsProduto, (72) produto, (73) idServico, (74) idOsServico, (75) desconto, (76) tipoDesconto, (77) resultado, (78) vencimento, (79) recebimento, (80) osid, (81) valor, (82) recebido, (83) formaPgto, (84) tipo, (85) anotacao, (86) idAnotacao in file application/controllers/Os.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
The CVSS vector lists privileges required as none, so an attacker does not need authenticated privileges. Exploitation does require user interaction.
Who is exposed to this issue?
Network-accessible Mapos deployments are in scope according to the CVSS attack vector. Users who interact with attacker-controlled XSS content are the immediate targets.
What version is explicitly identified as affected?
The provided information identifies Mapos 4.39.0 as affected. It does not establish whether earlier or later versions are vulnerable.
What remediation is available?
A patch is available. No alternative workaround or compensating control is provided in the available data.