CyberRota Analysis
AI-GeneratedA stored cross-site scripting vulnerability exists in the resolver_url parameter of the luci-app-https-dns-proxy, affecting Java applications. This flaw allows authenticated users to inject malicious HTML, which executes JavaScript in the browser of an administrator viewing the status page, potentially leading to unauthorized actions or data exposure. Organizations using this application should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.