CVE-2023-45279: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

October 19, 2023 (updated October 25, 2023)

Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There’s a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.

References

github.com/advisories/GHSA-4cqv-q33x-wfxw
github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7
nvd.nist.gov/vuln/detail/CVE-2023-45279
www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies

Code Behaviors & Features

Detect and mitigate CVE-2023-45279 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →