Details

    • Bug
    • Resolution: Fixed
    • Minor
    • None
    • CE-22.5
    • Discovery

    Description

      Observium is vulnerable to HTML injection via LLDP neighbour discovery. This happens if a port sees a neighbour with a system name of <script>alert('injection!')</script>.

      In the "neighbours view" of that port, a yellow triangle will be shown to indicate that autodiscovery is not working properly. Hovering over that triangle will trigger the injected payload.

       

      Keep up the good work! Cheers!

      Attachments

        Activity

          [OBS-4584] HTML injection vulnerability
          landy Mike Stupalov made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: In Progress [ 3 ] New: Resolved [ 5 ]
          landy Mike Stupalov made changes -
          Status Original: Pending Response [ 10000 ] New: In Progress [ 3 ]
          bot Observium Bot made changes -
          Status Original: Open [ 1 ] New: Pending Response [ 10000 ]
          zluudg zluudg created issue -

          People

            landy Mike Stupalov
            zluudg zluudg
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: