修正版
2.1.1810
CVE-2022-1346 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities within the causefx/organizr GitHub repository. These vulnerabilities allow attackers to inject malicious scripts into the application, potentially compromising user accounts and sensitive data. The vulnerability affects versions of Organizr up to and including 2.1.1810. A fix has been released in version 2.1.1810.
The XSS vulnerabilities in Organizr allow an attacker to inject arbitrary JavaScript code into the application's interface. This code executes within the context of the user's browser, granting the attacker the ability to steal session cookies, redirect users to malicious websites, or deface the application. Successful exploitation could lead to complete account takeover, unauthorized access to sensitive information, and further compromise of the user's system. The impact is particularly severe given the potential for widespread user compromise if Organizr is deployed within an organization.
CVE-2022-1346 was publicly disclosed on April 13, 2022. While no active exploitation campaigns have been definitively linked to this vulnerability, the CRITICAL severity and ease of exploitation make it a high-priority target. No public proof-of-concept exploits were immediately available, but the nature of XSS vulnerabilities means that such exploits are likely to emerge. This CVE is not currently listed on CISA KEV.
Organizations and individuals using Organizr for task management and organization are at risk. This includes teams relying on the application for project tracking, personal users utilizing it for to-do lists, and potentially shared hosting environments where multiple users share the same instance of Organizr.
• generic web: Check for suspicious JavaScript code in the application's source code or rendered HTML. Use browser developer tools to inspect network requests and responses for unexpected scripts.
• generic web: Examine access and error logs for patterns indicative of XSS attempts, such as unusual characters or script tags in user input.
• generic web: Use curl/wget to test various input fields with basic XSS payloads (e.g., <script>alert(1)</script>) and observe the response for script execution.
disclosure
エクスプロイト状況
EPSS
0.37% (59% パーセンタイル)
CVSS ベクトル
The primary mitigation for CVE-2022-1346 is to immediately upgrade Organizr to version 2.1.1810 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data within the application. While not a complete solution, this can help reduce the attack surface. Web application firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide an additional layer of defense. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into various input fields and confirming that the script is not executed.
Actualice Organizr a la versión 2.1.1810 o posterior. Esta versión contiene una corrección para la vulnerabilidad XSS almacenada. La actualización se puede realizar a través de la interfaz de administración de Organizr o descargando la última versión del repositorio de GitHub y siguiendo las instrucciones de instalación.
脆弱性分析と重要アラートをメールでお届けします。
CVE-2022-1346 is a critical stored XSS vulnerability in Organizr versions 2.1.1810 and earlier, allowing attackers to execute malicious scripts in user browsers.
Yes, if you are using Organizr version 2.1.1810 or earlier, you are vulnerable to this XSS attack.
Upgrade Organizr to version 2.1.1810 or later to resolve the vulnerability. Implement input validation and output encoding as a temporary mitigation.
While no confirmed active exploitation campaigns are known, the CRITICAL severity makes it a likely target for attackers.
Refer to the causefx/organizr GitHub repository for updates and advisories related to CVE-2022-1346: https://github.com/causefx/organizr