Non évaluée
Reflected Cross-Site-Scripting (XSS)
CVE-2024-25976
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the content of "$_SERVER['PHP_SELF']" is reflected into the HTML of the website. Hence the attacker does not need a valid account in order to exploit this issue.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory r.sec-consult.com
- package github.com
- patch github.com
- web seclists.org