CVE-2024-10719: Stored Cross-site Scripting (XSS) in phpipam/phpipam
A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10719?
CVE-2024-10719 has a medium severity rating due to its potential impact on user data and application integrity.
How do I fix CVE-2024-10719?
To fix CVE-2024-10719, upgrade phpipam to version 1.5.3 or later, where the vulnerability has been patched.
What type of vulnerability is CVE-2024-10719?
CVE-2024-10719 is categorized as a stored cross-site scripting (XSS) vulnerability.
What can an attacker do with CVE-2024-10719?
An attacker can inject malicious scripts via the 'option' parameter in a POST request, compromising the application.
In which version of phpipam is CVE-2024-10719 present?
CVE-2024-10719 is present in phpipam version 1.5.2.