CVE-2024-0948: NetBox Home Page Configuration config-revisions cross site scripting
DISPUTED A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0948?
CVE-2024-0948 is classified as problematic due to its potential impact on the Home Page Configuration in NetBox.
How do I fix CVE-2024-0948?
To remediate CVE-2024-0948, upgrade NetBox to a version higher than 3.7.0.
What component is affected by CVE-2024-0948?
CVE-2024-0948 affects the Home Page Configuration component in NetBox.
Which versions of NetBox are impacted by CVE-2024-0948?
CVE-2024-0948 impacts NetBox versions up to and including 3.7.0.
Is there any known exploit for CVE-2024-0948?
Details regarding an exploit for CVE-2024-0948 are currently unclear, as the vulnerability is marked as disputed.