PT-2017-10772 · Openmediavault · Openmediavault

Publicado 2017-07-13 · Atualizado 2017-07-21 · CVE-2017-1000065

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenMediaVault version 2.1

Description The issue concerns multiple Cross-site scripting (XSS) vulnerabilities in the rpc.php file, specifically within the Access Rights Management (Users) functionality. This allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.

Recommendations For OpenMediaVault version 2.1, update the Access Rights Management (Users) functionality to prevent XSS vulnerabilities, ensuring that user input is properly sanitized to prevent the injection of malicious scripts. As a temporary workaround, consider restricting access to the rpc.php file until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1000065

Produtos afetados

Openmediavault

Referências · 3

• https://github.com/openmediavault/openmediavault/commit/b2db1e24d0e52b961b5c3b3329b6ee717cac53a2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000065 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000065 · Aviso do Fabricante