CVE-2022-22109 DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title
Low-privileged users can inject malicious scripts into task titles, leading to code execution in victims' browsers when viewing tasks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-22109?
CVE-2022-22109 is a medium-severity cross-site scripting vulnerability in Bottelet DaybydayCRM, published on 5 Jan 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Weakness: CWE-79
Which versions are affected by CVE-2022-22109?
2 open source packages ship an affected version, including bottelet/flarepoint. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bottelet/flarepoint Packagist | All versions | 2.2.1 |
bottelet/flarepoint Packagist | All versions | 2.2.1 |
Products include Daybydaycrm Daybyday Crm.
How do I fix CVE-2022-22109?
Upgrade bottelet/flarepoint to 2.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-22109 being exploited?
There is no known exploitation of CVE-2022-22109 in the wild and no public exploit code.
Other vulnerabilities in Bottelet DaybydayCRM
Sources
Also known as GHSA-jr37-66pj-36v7.