CVE-2022-4068

Summary

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.

Affected Software

VendorProductVersion RangeStatus
librenmslibrenms/librenmsunspecified < 22.10.0affected

Weaknesses

  • CWE-915: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References