GHSA-f3hw-3h74-wr98
Cross-site Scripting in librenms/librenms
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | librenms/librenms | < 22.10.0 | 22.10.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
References
External links from the advisory. They lead to third-party sites.