CVE-2022-4068
Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Un usuario puede habilitar su propia cuenta si un administrador la deshabilitó mientras el usuario aún tiene una sesión válida. Además, el nombre de usuario no se sanitiza adecuadamente en la descripción general del usuario administrador. Esto habilita un ataque XSS que permite a un atacante con un usuario con privilegios bajos ejecutar JavaScript arbitrario en el contexto de la cuenta de un administrador.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-11-20 CVE Reserved
- 2022-11-20 CVE Published
- 2024-06-12 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://huntr.dev/bounties/becfecc4-22a6-4f94-bf83-d6030b625fdc | 2024-08-03 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/librenms/librenms/commit/09a2977adb8bc4b1db116c725d661160c930d3a1 | 2022-11-29 |
| URL | Date | SRC |
|---|