CVE-2022-4068
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Résumé
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.dev