Platform
other
Component
organizr
Fixed in
2.1.1810
CVE-2022-1346 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities within the causefx/organizr GitHub repository. These vulnerabilities allow attackers to inject malicious scripts into the application, potentially compromising user accounts and sensitive data. The vulnerability affects versions of Organizr up to and including 2.1.1810. A fix has been released in version 2.1.1810.
The XSS vulnerabilities in Organizr allow an attacker to inject arbitrary JavaScript code into the application's interface. This code executes within the context of the user's browser, granting the attacker the ability to steal session cookies, redirect users to malicious websites, or deface the application. Successful exploitation could lead to complete account takeover, unauthorized access to sensitive information, and further compromise of the user's system. The impact is particularly severe given the potential for widespread user compromise if Organizr is deployed within an organization.
CVE-2022-1346 was publicly disclosed on April 13, 2022. While no active exploitation campaigns have been definitively linked to this vulnerability, the CRITICAL severity and ease of exploitation make it a high-priority target. No public proof-of-concept exploits were immediately available, but the nature of XSS vulnerabilities means that such exploits are likely to emerge. This CVE is not currently listed on CISA KEV.
Exploit Status
EPSS
0.37% (59% percentile)
CVSS Vector
The primary mitigation for CVE-2022-1346 is to immediately upgrade Organizr to version 2.1.1810 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data within the application. While not a complete solution, this can help reduce the attack surface. Web application firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide an additional layer of defense. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into various input fields and confirming that the script is not executed.
Actualice Organizr a la versión 2.1.1810 o posterior. Esta versión contiene una corrección para la vulnerabilidad XSS almacenada. La actualización se puede realizar a través de la interfaz de administración de Organizr o descargando la última versión del repositorio de GitHub y siguiendo las instrucciones de instalación.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2022-1346 is a critical stored XSS vulnerability in Organizr versions 2.1.1810 and earlier, allowing attackers to execute malicious scripts in user browsers.
Yes, if you are using Organizr version 2.1.1810 or earlier, you are vulnerable to this XSS attack.
Upgrade Organizr to version 2.1.1810 or later to resolve the vulnerability. Implement input validation and output encoding as a temporary mitigation.
While no confirmed active exploitation campaigns are known, the CRITICAL severity makes it a likely target for attackers.
Refer to the causefx/organizr GitHub repository for updates and advisories related to CVE-2022-1346: https://github.com/causefx/organizr
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.