Description
Observium is vulnerable to HTML injection via LLDP neighbour discovery. This happens if a port sees a neighbour with a system name of <script>alert('injection!')</script>.
In the "neighbours view" of that port, a yellow triangle will be shown to indicate that autodiscovery is not working properly. Hovering over that triangle will trigger the injected payload.
Keep up the good work! Cheers!
Attachments
Activity
Resolution | New: Fixed [ 1 ] | |
Status | Original: In Progress [ 3 ] | New: Resolved [ 5 ] |
Status | Original: Pending Response [ 10000 ] | New: In Progress [ 3 ] |
Status | Original: Open [ 1 ] | New: Pending Response [ 10000 ] |