CVE-2022-2028: Generic XSS in kromitgmbh/titra
CVE ID: CVE-2022-2028
Date: June 9, 2022
Severity: Medium (CVSS 3.1: 5.4)
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Affected: kromitgmbh/titra prior to 0.77.0
Fixed in: 0.77.0
🔍 Overview
A generic cross-site scripting (XSS) vulnerability exists in GitHub repository kromitgmbh/titra prior to version 0.77.0. The application does not properly sanitize user-controlled input before reflecting it back in web pages, allowing an attacker to inject and execute arbitrary JavaScript in the context of other users’ sessions.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector: Network, low complexity, low privileges, user interaction required, changed scope.
🎯 Impact
Successful exploitation allows an attacker to run arbitrary JavaScript in a victim’s browser, potentially leading to:
- Session cookie theft and account takeover
- Unauthorized actions performed as the victim
- Phishing or credential harvesting via injected forms
🛡️ Mitigation
Upgrade to titra 0.77.0 or later. Apply context-aware output encoding for all user-supplied data rendered in HTML, and validate input on both client and server sides.