Unrated
Reflected Cross-Site-Scripting (XSS)
CVE-2024-25976
First seen on SecPulse
Original description The description as published by the source.
When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory r.sec-consult.com
- package github.com
- patch github.com
- web seclists.org