In breve
- CVE-2019-17625 è una vulnerabilità CRITICO (CVSS 9.0) che riguarda rambox (rambox), Rambox.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.0%, superiore al 87.5% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| rambox | = 0.6.9
| No fix yet |
| Rambox npm | ≤ 0.6.9
| No fix yet |
Description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
NVD description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free