CVE-2024-49379 Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel

Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting XSS vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vulnerability. If a JavaScript URL is passed...

CVE-2024-49379

UmbrelOS prior to 1.2.2 has a reflected XSS in use-auth.tsx via a malicious redirect parameter. If a JavaScript URL is used in redirect, attacker-provided JS can run after password entry at login. Fixed in 1.2.2. Upgrade to 1.2.2 or later; as workaround, disable login or restrict access to the us...