CVE-2022-22115

    Dashboard / Vulnerabilities / CVE-2022-22115

    CVE-2022-22115

    Published: 10 Jan 2022Last Modified: 12 Aug 2026

    Summary: Teedy - Stored Cross-Site Scripting (XSS) in Tag Name

    Details: In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.

    References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22115.json, https://nvd.nist.gov/vuln/detail/CVE-2022-22115, https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ea210d6aac6e69231e835206e0ce0daadcccd83b
    Fixed -4951229576d6892dc58ab8c572e73639ca82d80c

    Affected versions

    v1.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-22115 | CVE-DB