CVE-2024-10723

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-10723

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10723.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-10723

Published

2025-03-20T10:15:19.267Z

Modified

2026-04-10T05:08:09.553409Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites. The issue has been fixed in version 1.7.0.

References

Affected packages

Git / github.com/phpipam/phpipam

Affected ranges

Type

GIT

Repo

https://github.com/phpipam/phpipam

Events

Introduced

Fixed

3271d956a581a00a7d4080426d5ca8f2c4b06102

Fixed

c1697bb6c4e4a6403d69c0868e1eb1040f98b731

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.0"
        }
    ]
}

Affected versions

v1.*

v1.16.003

v1.19.008

v1.2.0_beta2

v1.3.0

v1.3.2

v1.5.0

v1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10723.json"