CVE-2024-45061
Published: 15 January 2025
Description
A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker.
Security Summary
CVE-2024-45061 is a cross-site scripting (XSS) vulnerability in the weather map editor functionality of Observium Community Edition (CE) version 24.4.13528. The flaw allows arbitrary JavaScript code execution through a specially crafted HTTP request, classified under CWE-79 with a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
An attacker can exploit this vulnerability by providing a malicious link to a low-privileged authenticated user, who must click it to trigger execution (UI:R). Over the network (AV:N) with low attack complexity (AC:L), successful exploitation enables high-impact confidentiality and integrity violations (C:H/I:H) in a changed scope (S:C), such as session hijacking or data exfiltration within the victim's browser context.
Details on mitigation, including patches or workarounds, are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2092.
Details
- CWE(s)