Description
Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on the Default Icon.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LiteSpeed Technologies | OpenLiteSpeed | 1.7.9 | — |
References
- ExploitDB-49727 exploit
- OpenLiteSpeed Vendor Homepage product
- VulnCheck Advisory: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting third-party-advisory