CVE-2023-3085 X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting
Remote attackers can execute arbitrary scripts via the 404 error template handler in X-WRT luci, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-3085?
CVE-2023-3085 is a low-severity cross-site scripting vulnerability in X-WRT luci, published on 3 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
Weakness: CWE-79
Which versions are affected by CVE-2023-3085?
It affects 1 product.
Products include X-Wrt Luci.
How do I fix CVE-2023-3085?
No fix has been published for CVE-2023-3085 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-3085 being exploited?
There is no known exploitation of CVE-2023-3085 in the wild and no public exploit code.
Sources
Also known as GHSA-444f-v7px-88pm.