PT-2022-24373

CVE-2022-38335

Published

2022-09-27

Updated

2022-09-29

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 7.4.0

Description A stored cross-site scripting (XSS) issue was found in the e-mail template modules. This allows for malicious scripts to be stored and executed when the module is accessed.

Recommendations For Vtiger CRM version 7.4.0, consider disabling the e-mail template modules until a patch is available to prevent potential exploitation of the stored XSS issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Corinna Rudlstorfer

Jakob Pachmann

Thomas Kostal

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')