CVE-2022-4068
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
概要
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.dev