Reflected Cross-Site Scripting Vulnerability in LuCI OpenWrt
CVE-2023-24181

5.4MEDIUM

Key Information:

Vendor

Openwrt

Status
Luci
Vendor
CVE Published:
10 April 2023

What is CVE-2023-24181?

A reflected cross-site scripting (XSS) vulnerability was identified in LuCI for the OpenWrt 22.03 branch. This vulnerability affects the component located at /openvpn/pageswitch.htm, allowing attackers to inject malicious scripts through user input. If successfully exploited, this could lead to unauthorized exposure of sensitive information or manipulation of the user session, posing significant security risks. Stemming from improperly sanitized input, this vulnerability necessitates immediate attention and remediation to protect user data.

References

https://github.com/openwrt/luci/commit/25983b9fa572a640a7...
https://github.com/openwrt/luci/commit/749268a2cad4a08722...
https://github.com/ABB-EL/external-vulnerability-disclosu...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.