CVE-2022-4068 — Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the adm…
Published: 2022-11-20 · CVSS: 7.6 · CVSS 3.0
A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7