CVE-2022-39054

Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.

Score

CVSS 3.1 6.1 Medium

Status

Modified - twcert@cert.org.tw

Published

2022-09-28

Last modified

2025-05-21

Weaknesses

CWE-79

Affected products

• Cowell Enterprise Travel Management System (Cowell Enterprise Travel Management System Project)
• Enterprise Travel Management System (Cowell Information System Co. Ltd.)

References

• https://www.twcert.org.tw/tw/cp-132-6524-74530-1.html