434 – Client-side template injection
Description
The application allows injecting malicious entries into a client-side command template. This vulnerability occurs when an attacker can use the template's template syntax to inject a malicious payload into a template, which is then executed on the client side.
Impact
- Generate dynamic client-side content. - Execution of unwanted code in the context of the user's browser. - Theft of sensitive information. - Manipulation of page content. - Malware propagation
Recommendation
Properly sanitize user-controlled inputs.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): L
- Integrity (SI): L
- Availability (SA): L
Threat 4.0
- Exploit maturity: P