CVE-2022-48118: 
Jorani vulnerability analysis and mitigation

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. The vulnerability was identified and assigned CVE-2022-48118 on January 27, 2023. The affected software is Jorani version 1.0, a leave management system (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts to confidentiality and integrity, and no impact to availability (NVD).

The cross-site scripting vulnerability could allow attackers to execute arbitrary web scripts or HTML in the context of the affected application. This could potentially lead to theft of sensitive data, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability can be exploited by modifying the length of the Acronym column in the database to allow for longer XSS payloads. When the page is subsequently viewed, the XSS payload is executed (Github Issue).