CVE-2024-7075: XSS
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.
Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.
Event History
Frequently Asked Questions
Does an attacker need privileges to exploit this issue?
No attacker privileges are required, but exploitation requires user interaction. The malicious script must be rendered in a user's browser through the management console.
Who is exposed to the malicious script?
Users of the management console are exposed when attacker-controlled input is rendered by the user search function. The script executes in the context of that user's management-console browser session.
Can this vulnerability be used to hijack management-console sessions?
The advisory states that sensitive session cookies use the httpOnly flag, preventing session hijacking or similar attacks through cookie access. An attacker may still redirect the browser, alter the page interface, or extract other information available from the browser.