Description
Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take over the service via malicious JavaScript in poisoned log entries
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CoolerControl coolercontrol-ui
Default version status: unaffected
2.0.0 to < 4.0.0affected
References
- https://gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L224 ↗
- https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.1/coolercontrol-ui/src/views/AppInfoView.vue?ref_type=tags#L350 ↗
- https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0 ↗