CVE-2022-3546

SourceCodester Simple Cold Storage Management System Create User cross site scripting

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User Handler. The manipulation of the argument First Name/Last Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-211046 is the identifier assigned to this vulnerability.

Se ha encontrado una vulnerabilidad en SourceCodester Simple Cold Storage Management System versión 1.0, y ha sido clasificada como problemática. Este problema afecta a una funcionalidad desconocida del archivo /csms/admin/?page=user/list del componente Create User Handler. La manipulación del argumento First Name/Last Name conlleva a un ataque de tipo un cross site scripting. El ataque puede ser lanzado remotamente. La explotación ha sido divulgada al público y puede ser usada. VDB-211046 es el identificador asignado a esta vulnerabilidad

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-10-17 CVE Reserved
2022-10-17 CVE Published
2023-05-10 First Exploit
2024-05-09 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-707: Improper Neutralization

CAPEC

References (3)

URL	Tag	Source
https://github.com/thehackingverse/Stored-xss-/blob/main/Poc	Third Party Advisory
https://vuldb.com/?id.211046	Third Party Advisory

URL	Date	SRC
https://github.com/thehackingverse/CVE-2022-3546	2023-05-10

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oretnom23 Search vendor "Oretnom23"		Simple Cold Storage Management System Search vendor "Oretnom23" for product "Simple Cold Storage Management System"				1.0 Search vendor "Oretnom23" for product "Simple Cold Storage Management System" and version "1.0"		-		Affected