CVE-2022-44949

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1

Description A stored cross-site scripting (XSS) issue was found in the Add New Field function at "/index.php?module=entities/fields&entities id=24". This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.

Recommendations For Rukovoditel version 3.2.1, consider disabling the Add New Field function at "/index.php?module=entities/fields&entities id=24" until a patch is available. Restrict access to the Short Name field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.