CVE-2022-22109 MEDIUM

CVE-2022-22109: DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title

Vendor Bottelet
Product DaybydayCRM
Weakness CWE-79 · XSS
Published January 5, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.

Key dates

02Disclosure timeline

January 5, 2022 CVE published
August 3, 2024 Record updated