| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| librenms/librenms | < 24.4.0 | 24.4.0 |
| librenms | < 24.4.0 | 24.4.0 |
There is improper sanitization on Service template name which is reflecting in delete button onclick event. This value can be modified and crafted as any other javascript code.
Above is vulnerable code line which needs to be properly sanitized
testing', '14', 'http://172.105.62.194:8000/services/templates/14');alert(1);//If you inspect element on delete button, you will notice this:- <img width="748" alt="Screenshot 2023-11-23 at 9 30 24 PM" src="https://user-images.githubusercontent.com/31764504/285260018-7672a93d-e29b-4444-8057-e6ffcb8dabfc.png">
Cross site scripting can lead to cookie stealing or an attacker can execute any other feature using this feature.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン