Users were able to set an arbitrary “product name” for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting attacks. Accounts that were temporarily taken over could be configured to trigger persistent code execution, allowing an attacker to build a foothold. Sanitization is in place for product names now. No publicly available exploits are known.
CPE | Name | Operator | Version |
---|---|---|---|
ox_guard | lt | 2.10.7 | |
ox_guard | eq | 2.10.7 | |
ox_guard | eq | 2.10.7 rev4 | |
ox_guard | eq | 2.10.7 rev5 | |
ox_guard | eq | 2.10.7 rev6 |