CVE-2024-49758

描述

### Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. ### Details User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the ExamplePlugin enable, if java script code is inside the device's Notes, its will be trigger. ### PoC 1. As an admin user, enable the ExamplePlugin.  2. Add the payload `<img src="x" onerror="alert(document.cookie)">` into the device Notes  3. Once visit the Overview of the Device, a pop-up will show up.  ### Impact It could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.

如何修補 CVE-2024-49758

要修補 CVE-2024-49758,請將受影響套件升級到下列已修補版本。

• —升級至 24.10.0 或更新版本

CVE-2024-49758 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 24.10.0

CVSS 分數