Cross-Site Scripting Vulnerability in OpenWrt Traffic Rules Configuration
CVE-2021-45905

5.4MEDIUM

Key Information:

Vendor

Openwrt

Status
Openwrt
Vendor
CVE Published:
27 December 2021

What is CVE-2021-45905?

OpenWrt version 21.02.1 is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited via the Traffic Rules Name screen. This flaw allows an attacker to inject malicious scripts into the web interface, which can lead to unauthorized actions being performed on behalf of users without their consent. Users and administrators are advised to apply security patches and mitigate risks associated with the exposure of this vulnerability.

References

https://bugs.openwrt.org/index.php?do=details&task_id=4199
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.