5.4
CVSSv3

CVE-2022-41435

Published: 03/11/2022 Updated: 04/11/2022
CVSS v3 Base Score: 5.4 | Impact Score: 2.7 | Exploitability Score: 2.3

Vulnerability Summary

OpenWRT LuCI version git-22.140.66206-02913be exists to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows malicious users to execute arbitrary web scripts or HTML via crafted public key comments.

Most Upvoted Vulmon Research Post

This vulnerability involves a rather unconventional vector for XSS - the comment field of an SSH public key. Since patched in newer versions of LuCI, which ensure to not display public key comments verbatim in order to prevent injection of any markup, including <script> tags.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openwrt luci git-22.140.66206-02913be