In short
- CVE-2019-17625 is a CRITICAL (CVSS 9.0) vulnerability affecting rambox (rambox), Rambox.
- Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.5% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| rambox | = 0.6.9
| No fix yet |
| Rambox npm | ≤ 0.6.9
| No fix yet |
Description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
NVD description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free