ALT-PU-2024-5961

Низкий

ALT-PU-2024-5961: package netbox update to version 3.7.4-alt1

Источник

errata.altlinux.org

Дата публикации

05.04.2024

Дата обновления

05.04.2024

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades netbox to version 3.7.4-alt1.

Устраненные уязвимости1

CVE-2024-0948

Средний 6.1

Дата публикации: 26.01.2024

CWE-79

>test

leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1

Средний 6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS 2.0

Низкий 3.3

AV:N/AC:L/Au:M/C:N/I:P/A:N

Access vector: Network
Complexity: Low
Authentication: Multiple
Confidentiality: None
Integrity: Partial
Availability: None

Ссылки

CVE-2024-0948 https://nvd.nist.gov/vuln/detail/CVE-2024-0948

Ссылки1

ALT-PU-2024-5961 https://errata.altlinux.org/ALT-PU-2024-5961

Связанные уязвимости

CVE-2024-0948

CVSS3: 6.1

nvd

почти 3 года назад

** DISPUTED ** A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2024-0948

CVSS3: 6.1

debian

почти 3 года назад

** DISPUTED ** A vulnerability, which was classified as problematic, h ...

GHSA-gwqg-xwh5-rjmm

CVSS3: 2.4

github

почти 3 года назад

A vulnerability, which was classified as problematic, has been found in NetBox up to 3.7.0. This issue affects some unknown processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input <<h1 onload=alert(1)>>test</h1> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252191. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.