En bref
- CVE-2019-17625 est une vulnérabilité CRITIQUE (CVSS 9.0) touchant rambox (rambox), Rambox.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.0%, plus élevée que 87.5% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| rambox | = 0.6.9
| No fix yet |
| Rambox npm | ≤ 0.6.9
| No fix yet |
Description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
NVD description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free