Missing Input Validation in OpenWrt Web Interface Allows XSS Vulnerability
CVE-2021-32019

6.1MEDIUM

Key Information:

Vendor

Openwrt

Status
Openwrt
Vendor
CVE Published:
2 August 2021

What is CVE-2021-32019?

A vulnerability in OpenWrt before version 19.07.8 results from inadequate input validation of host names within the luci web interface on the Connection Status page. This flaw can lead to Cross-Site Scripting (XSS), enabling an attacker to execute malicious scripts in the context of the user's session. By exploiting this vulnerability, attackers can potentially gain full control over the device through ICMP, jeopardizing the security and privacy of the affected system.

References

https://openwrt.org/advisory/2021-08-01-1
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.