PT-2017-10772 · Openmediavault · Openmediavault

Published 2017-07-13 · Updated 2017-07-21 · CVE-2017-1000065

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenMediaVault version 2.1

Description The issue concerns multiple Cross-site scripting (XSS) vulnerabilities in the rpc.php file, specifically within the Access Rights Management (Users) functionality. This allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.

Recommendations For OpenMediaVault version 2.1, update the Access Rights Management (Users) functionality to prevent XSS vulnerabilities, ensuring that user input is properly sanitized to prevent the injection of malicious scripts. As a temporary workaround, consider restricting access to the rpc.php file until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000065

Affected Products

Openmediavault

References · 3

• https://github.com/openmediavault/openmediavault/commit/b2db1e24d0e52b961b5c3b3329b6ee717cac53a2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000065 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000065 · Vendor Advisory