We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
An authenticated malicious user can take advantage of a Stored XSS vulnerability in "Create Regions" function in the "Organization" feature.
/dcim/regions/
<img src=1 onerror='alert(document.cookie)'/>
/dcim/sites/
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Version: 3.5.1
Description
An authenticated malicious user can take advantage of a Stored XSS vulnerability in "Create Regions" function in the "Organization" feature.
Proof of Concept
Step 1: Go to
/dcim/regions/, click "Add" and insert payload "<img src=1 onerror='alert(document.cookie)'/>" in "Name" field.Step 2: Go to
/dcim/sites/, click "Add" and select "Region"**Step 3: Script excuted
Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered: