CVE-2024-10720: Stored Cross-site Scripting (XSS) in phpipam/phpipam
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10720?
CVE-2024-10720 is classified as a medium severity stored XSS vulnerability.
How do I fix CVE-2024-10720?
To fix CVE-2024-10720, upgrade phpipam/phpipam to version 1.5.3 or later where the issue has been addressed.
What versions of phpipam are affected by CVE-2024-10720?
CVE-2024-10720 affects phpipam/phpipam version 1.5.2.
What is the potential impact of CVE-2024-10720?
The potential impact of CVE-2024-10720 includes the ability for attackers to execute arbitrary JavaScript in the context of the victim's browser.
How can I identify exploitation of CVE-2024-10720 in my system?
Exploitation of CVE-2024-10720 can be identified by monitoring for unusual script injections in the 'Name' and 'Description' fields in the Device Management section.