NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments.
References
Link | Resource |
---|---|
http://www.cinquino.eu/NetBox.htm | Exploit Third Party Advisory |
https://github.com/netbox-community/netbox/issues/3471 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
02 Feb 2024, 13:54
Type | Values Removed | Values Added |
---|---|---|
First Time |
Netbox
Netbox netbox |
|
CPE | cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:* |
06 Jan 2021, 16:34
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/netbox-community/netbox/issues/3471 - Exploit, Issue Tracking, Third Party Advisory | |
References | (MISC) http://www.cinquino.eu/NetBox.htm - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
CPE | cpe:2.3:a:netbox_project:netbox:*:*:*:*:*:*:*:* | |
CWE | CWE-79 |
31 Dec 2020, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2020-12-31 20:15
Updated : 2024-02-02 13:54
NVD link : CVE-2019-25011
Mitre link : CVE-2019-25011
CVE.ORG link : CVE-2019-25011
JSON object : View
Products Affected
netbox
- netbox
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')