CVE-2022-2026: Stored XSS in kromitgmbh/titra
CVE ID: CVE-2022-2026
Date: June 9, 2022
Severity: Medium (CVSS 3.1: 5.4)
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Affected: kromitgmbh/titra prior to 0.77.0
Fixed in: 0.77.0
🔍 Overview
A stored cross-site scripting (XSS) vulnerability exists in GitHub repository kromitgmbh/titra prior to version 0.77.0. The application fails to properly neutralize user-supplied input before rendering it in a web page, allowing an attacker to inject arbitrary JavaScript that executes in the context of other users’ browsers.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector: Network, low complexity, low privileges, user interaction required, changed scope.
🎯 Impact
An authenticated attacker with low privileges can store malicious scripts in the application. When another user (including administrators) views the affected page, the script executes in their browser, potentially leading to:
- Session hijacking or credential theft
- Unauthorized actions performed on the victim’s behalf
- Defacement or data exfiltration
🛡️ Mitigation
Upgrade to titra 0.77.0 or later. Ensure all user-supplied input is properly escaped or sanitized before being rendered in HTML contexts. Apply output encoding appropriate to the context (HTML, attribute, JavaScript, etc.).