GitHub Advisoryadvisory · Maven

GHSA-4cqv-q33x-wfxw Yamcs Cross-site Scripting vulnerability

MEDIUM Published 2023-10-20 Modified 2023-10-31 Official page ↗
Aliases
CVE-2023-45279
Ecosystem
Maven
Packages
org.yamcs:yamcs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-10-20

Affected packages

• Maven org.yamcs:yamcs: < 5.8.7 → fixed in 5.8.7

Description

Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References