LF Edge eKuiper has Stored XSS in Rules Functionality
Résumé
LF Edge eKuiper has Stored XSS in Rules Functionality
Description d'origine
La description telle que publiée par la source (souvent en anglais).
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com