Vulnerability Description
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Librenms | Librenms | < 22.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/librenms/librenms/commit/09a2977adb8bc4b1db116c725d661160c930PatchThird Party Advisory
- https://huntr.dev/bounties/becfecc4-22a6-4f94-bf83-d6030b625fdcExploitPatchThird Party Advisory
- https://github.com/librenms/librenms/commit/09a2977adb8bc4b1db116c725d661160c930PatchThird Party Advisory
- https://huntr.dev/bounties/becfecc4-22a6-4f94-bf83-d6030b625fdcExploitPatchThird Party Advisory
FAQ
What is CVE-2022-4068?
CVE-2022-4068 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This ...
How severe is CVE-2022-4068?
CVE-2022-4068 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-4068?
Check the references section above for vendor advisories and patch information. Affected products include: Librenms Librenms.