Read the docs
TI-2022-08260 Aliases CVE-2022-24384GHSA-fhxg-444p-h63x

Reflective XSS on SmarterTrack v100.0.8019.14010

Priority MEDIUM 47CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0409 90th percentileScored 2026-11-07
Fix Fixed SmarterTrack (SmarterTools): Build 8075

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmarterToolsSmarterTrack100.x to before Build 8075Build 8075Patch availableCNA
  • SmarterTrack VendorSmarterTools Affected 100.x to before Build 8075 Fixed in Build 8075 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:*before 100.0.8075VulnerableSmarterTools
  • cpe:2.3:a:smartertools:smartertrack:*:*:*:*:*:*:*:* Versions before 100.0.8075 Vulnerable ·SmarterTools

Remediation

  • Fix · CNA SmarterTrack (SmarterTools) Fixed in Build 8075

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SmarterTools SmarterTrack Build 8075

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-08263 File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010Priority MEDIUM 45
    • TI-2022-08262 Stored XSS in SmarterTrack v100.0.8019.14010Priority LOW 39
    • TI-2022-08261 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010Priority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24384
  2. 2026-10-03 Alias added: GHSA-fhxg-444p-h63x

References

Advisory 2

  • TI-2020-19061 SmarterTools SmarterTrack 7922 -Information Disclosure CVSS 4.0MEDIUM 6.9
  • TI-2022-08263 File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010 CVSS 3.1CRITICAL 9.1
  • TI-2022-08262 Stored XSS in SmarterTrack v100.0.8019.14010 CVSS 3.1HIGH 8.8
  • TI-2022-08261 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 CVSS 3.1MEDIUM 6.5
  • TI-2009-04751 Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack… CVSS 2.0MEDIUM 4.3
  • TI-2009-04750 Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences