exploitDog

CVE-2022-36137

Опубликовано: 29 нояб. 2022

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Ссылки

https://github.com/ChurchCRM/CRM/releases/tag/4.4.5
Release Notes
Third Party Advisory
https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-sheader-2ed4184030f7
Exploit
Third Party Advisory
https://github.com/ChurchCRM/CRM/releases/tag/4.4.5
Release Notes
Third Party Advisory
https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-sheader-2ed4184030f7
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:churchcrm:churchcrm:4.4.5:*:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00243

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

CWE-79

Связанные уязвимости

GHSA-cxvx-jrq9-m836

CVSS3: 4.8

github

около 3 лет назад

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

EPSS

Процентиль: 47%

0.00243

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

CWE-79