| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| librenms/librenms | < 25.7.0 | 25.7.0 |
| librenms | < 25.7.0 | 25.7.0 |
Reflected-XSS in report_this function in librenms/includes/functions.php
Recently, it was discovered that the report_this function had improper filtering (htmlentities function was incorrectly used in a href environment), which caused the project_issues parameter to trigger an XSS vulnerability.
The Vulnerable Sink: https://github.com/librenms/librenms/blob/master/includes/functions.php#L444
GET
project_issues=javascript:alert(document.cookie)
XSS vulnerabilities allow attackers to execute malicious scripts in users' browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.
It is recommended to filter dangerous protocols, e.g. javascript:/file:.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí