CVE-2022-31455

* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a user chat box.

CVSS v3.0 6.1 MEDIUM

6.1^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.acunetix.com/vulnerabilities/web/cross-site-scripting/	Third Party Advisory
https://medium.com/%40rohitgautam26/cve-2022-31455-bc929f477446

Configurations

Configuration 1 (hide)

cpe:2.3:a:truedesk:truedesk:1.2.2:*:*:*:*:*:*:*

History

07 Nov 2023, 03:47

Type	Values Removed	Values Added
References	~~{'url': 'https://medium.com/@rohitgautam26/cve-2022-31455-bc929f477446', 'name': 'https://medium.com/@rohitgautam26/cve-2022-31455-bc929f477446', 'tags': ['Third Party Advisory'], 'refsource': 'MISC'}~~	() https://medium.com/%40rohitgautam26/cve-2022-31455-bc929f477446 -

01 Aug 2023, 20:41

Type	Values Removed	Values Added
References	~~(MISC) https://medium.com/@rohitgautam26/cve-2022-31455-bc929f477446 -~~	(MISC) https://medium.com/@rohitgautam26/cve-2022-31455-bc929f477446 - Third Party Advisory
References	~~(MISC) https://www.acunetix.com/vulnerabilities/web/cross-site-scripting/ -~~	(MISC) https://www.acunetix.com/vulnerabilities/web/cross-site-scripting/ - Third Party Advisory
First Time		Truedesk Truedesk truedesk
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:truedesk:truedesk:1.2.2:::::::*
CWE		CWE-79

26 Jul 2023, 21:40

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-26 21:15

Updated : 2023-11-07 03:47

NVD link : CVE-2022-31455

Mitre link : CVE-2022-31455

JSON object : View

Products Affected

truedesk

truedesk

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10