Severity by source
Network-delivered stored XSS requiring low-privilege write access and victim browser interaction; scope changes as payload executes in victim's session context; no direct availability impact.
Lifecycle Timeline
1Description PRE-NVD
AnalysisAI
Stored cross-site scripting in the contacts component of NethServer's WebTop groupware module allows an authenticated attacker to inject persistent JavaScript into shared address book fields, which executes silently in any victim's browser upon viewing the poisoned contact record. All WebTop installations on version 1.5.6 and earlier are at risk; successful exploitation can cascade into session hijacking, credential theft, and unauthorized access across all integrated groupware services including email and file storage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, low-privilege account on the targeted NethServer WebTop instance - specifically one with write access to the shared address book (contacts) component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.2 accurately reflects a genuinely high-impact class of vulnerability: the network attack vector, low complexity, and low-privilege barrier make this accessible to any account holder within the platform, and the stored nature ensures the payload persists and reactivates with each new victim viewer until the record is cleaned or the system is patched. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with a standard WebTop account navigates to the shared address book and creates or edits a contact, injecting a JavaScript payload into an insufficiently sanitized field such as the display name or notes. When a second WebTop user opens that contact record in their browser as part of routine workflow, the stored script executes in their session context, exfiltrating their authentication cookie to an attacker-controlled endpoint and granting full control of the victim's WebTop session. … |
| Remediation | The primary and recommended fix is to upgrade the WebTop module to version 1.5.7, which resolves the insufficient sanitization and encoding defects in the contacts component. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today