CVE-2022-4068
published 2022-11-20CVE-2022-4068: A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly…
PriorityP339medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
33.97%
98.2th percentile
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| librenms | librenms | < 22.10.0 | 22.10.0 |
| librenms | librenms | >= 0 < 22.10.0 | 22.10.0 |
| librenms | librenms_librenms | >= unspecified < 22.10.0 | 22.10.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv3.07.6HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
cisa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-site Scripting in librenms/librenms
osv·2022-11-20
CVE-2022-4068 [HIGH] Cross-site Scripting in librenms/librenms
Cross-site Scripting in librenms/librenms
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
GHSA
Cross-site Scripting in librenms/librenms
ghsa·2022-11-20
CVE-2022-4068 [HIGH] CWE-79 Cross-site Scripting in librenms/librenms
Cross-site Scripting in librenms/librenms
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
CISA
Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
cisa·2022-03-25·CVSS 9.1
CVE-2015-4068 [CRITICAL] CWE-22 Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
Vulnerability: Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability
Affected: Arcserve Unified Data Protection (UDP)
Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-4068
Remediation Due Date: 2022-04-15
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-20
Published