| Package | Affected versions | Patched versions |
|---|---|---|
| thruk | = 2.40-2 |
Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free