CVE-2022-22114

    Dashboard / Vulnerabilities / CVE-2022-22114

    CVE-2022-22114

    Published: 10 Jan 2022Last Modified: 12 Aug 2026

    Summary: Teedy - Reflected Cross-Site Scripting (XSS) in the Search Functionality

    Details: In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.

    References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22114.json, https://nvd.nist.gov/vuln/detail/CVE-2022-22114, https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ea210d6aac6e69231e835206e0ce0daadcccd83b
    Fixed -4951229576d6892dc58ab8c572e73639ca82d80c

    Affected versions

    v1.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-22114 | CVE-DB