Lucene search

Veracode Vulnerability DatabaseVERACODE:47204

HistoryMay 28, 2024 - 4:56 a.m.

Cross-Site Scripting

2024-05-2804:56:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

phpservermon

cross-site scripting

input validation

index.php

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

6.7

Confidence

High

EPSS

Percentile

9.0%

JSON

phpservermon/phpservermon is vulnerable to Cross-Site Scripting. The vulnerability is due to the lack of proper validation of input parameters in index.php, which allows an attacker to create a specially crafted URL and send it to a victim, to retrieve their session details.

References

github.com/advisories/GHSA-rq7f-j68f-mqh3

github.com/PHPMailer/PHPMailer/commit/ff8718f72225a2e34d918c06a3b2c8cca5af3164

www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor