Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments.
References
| Link | Resource |
|---|---|
| https://www.exploit-db.com/exploits/43122/ | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/43122/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
04 Feb 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. This vulnerability presents a potential risk for widespread exploitation in connected IoT environments. |
21 Nov 2024, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.exploit-db.com/exploits/43122/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2017-11-10 02:29
Updated : 2025-02-04 21:15
NVD link : CVE-2017-16567
Mitre link : CVE-2017-16567
CVE.ORG link : CVE-2017-16567
JSON object : View
Products Affected
logitech
- media_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')