CVE-2023-25827
Cross-site Scripting in OpenTSDB
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.2EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
03 may 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a reflected XSS vulnerability with the suggestion endpoint.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Productos afectados
OpenTSDB · OpenTSDB¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →