Stored Cross-Site Scripting Vulnerability in LuCI for OpenWRT
CVE-2023-24182

5.4MEDIUM

Key Information:

Vendor

Openwrt

Status
Openwrt
Vendor
CVE Published:
11 April 2023

What is CVE-2023-24182?

The LuCI interface within the OpenWRT 22.03 branch has been found to contain a stored cross-site scripting vulnerability, particularly through its /system/sshkeys.js component. This flaw allows attackers to execute arbitrary scripts in the context of the user’s browser, potentially compromising sensitive information and user sessions. Affected users are advised to review related security updates for a patch and mitigate any associated risks.

References

https://github.com/openwrt/luci/commit/0186d7eae0e123a409...
https://github.com/openwrt/luci/commit/aa7938d4cb3a3f889d...
https://github.com/openwrt/luci/commit/588381e2111079265c...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.