CVE-2022-2890: XSS in YetiForceCRM

The XSS vulnerability in YetiForceCRM allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they visit a compromised page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the application. The impact is particularly severe because XSS vulnerabilities can be exploited to compromise user accounts with elevated privileges, potentially granting the attacker access to sensitive data and control over the CRM system. Successful exploitation could lead to unauthorized access to customer data, financial records, and other confidential information stored within the CRM.

1. Reserved2022-08-18
2. Published2022-08-22
3. Modified2024-08-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-2890 is to upgrade YetiForceCRM to version 6.4.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on user-supplied data to reduce the attack surface. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly scan the application for XSS vulnerabilities using automated tools.