PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The "Site title" setting is injected in several locations which triggers the XSS.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/osbourne/ | Exploit Third Party Advisory |
| https://github.com/phpipam/phpipam/releases/tag/v1.4.5 | Release Notes Third Party Advisory |
Configurations
History
25 Jan 2022, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
| CPE | cpe:2.3:a:phpipam:phpipam:1.4.4:*:*:*:*:*:*:* | |
| References | (MISC) https://fluidattacks.com/advisories/osbourne/ - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/phpipam/phpipam/releases/tag/v1.4.5 - Release Notes, Third Party Advisory | |
| CWE | CWE-79 |
19 Jan 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-19 21:15
Updated : 2024-02-04 22:08
NVD link : CVE-2022-23045
Mitre link : CVE-2022-23045
CVE.ORG link : CVE-2022-23045
JSON object : View
Products Affected
phpipam
- phpipam
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')