CVE-2022-4068
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Original description
The description as published by the source.
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.dev