Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A stored Cross-site Scripting (XSS) vulnerability was identified in the Custom RSE Attribute of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. --- Details A stored XSS payload can be introduced via a custom RSE attribute value and is later rendered when the RSE is viewed. Create Path: Admin RSE Management RSE NAME Add Attribute Trigger Path: Admin RSE Management RSE NAME Request Response Storing XSS Payload in RSE Attribute <img width="1234" height="844" alt="Storing XSS Payload in RSE Attribute" src="https://github.com/user-attachments/assets/d10f58c2-8cea-43a9-bf7f-f94ef3d1fd81" / XSS Payload triggering when viewing RSE <img width="1248" height="949" alt="XSS Payload triggering when viewing RSE"…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-site Scripting (XSS) vulnerability was identified in the Identity Name of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. --- Details The identity name is stored and later rendered without output encoding. Create Path: Admin Account Management ACCOUNT NAME Add Account Identity Trigger Path: Admin Account Management ACCOUNT NAME (https://127.0.0.1:8443/ui/account?account=pentest) Request Response Storing XSS payload in account identity name <img width="1385" height="807" alt="Storing XSS payload in account identity name" src="https://github.com/user-attachments/assets/e4209ef4-fd88-492f-9fb0-afb7d04b15ce" / Triggering XSS payload when viewing account <img width="1395" height="745" alt="Triggering XSS payload…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-site Scripting (XSS) vulnerability was identified in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. --- Details Several metadata fields accept arbitrary input which is stored and later rendered unsafely in the WebUI when the RSEs are listed in the RSE Management dashboard. Create Path: Admin RSE Management Trigger Paths: Admin RSE Management Admin RSE Management RSE NAME Vulnerable Attributes: City, CountryName, ISP Request Response Stored XSS payload triggering in RSE listing after adding XSS payload in metadata <img width="1252" height="624" alt="Stored XSS payload triggering in RSE listing after adding XSS payload in metadata"…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-site Scripting (XSS) vulnerability was identified in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. --- Details A malicious payload supplied in the comment field is stored by the backend. When the rule is later viewed or approved, the stored script executes in the WebUI origin. Create Path: Monitoring Subscriptions and Rules Request New Rule Options Add Comment Trigger Paths: - User Trigger: Monitoring Subscriptions and Rules Show My Rules RULE NAME (https://localhost:8443/ui/rule?ruleid=<RULEID) - Admin Trigger: Data Transfer (R2D2) Approve Rules RULE NAME Create Request Response Creating RSE with XSS payload in comment <img width="1032" height="667" alt="Creating RSE with XSS…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Details When submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on the existence of the provided username (identity). A non-existent username results in an error indicating that no account is associated with the identity, while an existing username with an incorrect password produces a different authentication-related error. This behavioral difference allows an attacker to distinguish valid usernames from invalid ones by observing the response content. Proof of Concept Bogus Login (Non-existent Username "15251087") Response contains: Bogus Login (Existing Username "root", Wrong Password) Response contains: The difference in error messages confirms whether a username exists. Impact An unauthenticated attacker can enumerate valid usernames, which may be…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected Cross-site Scripting vulnerability was located in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Details The WebUI error message renders ExceptionMessage (which can contain user-controlled input) as unencoded HTML. Server code that produces the message is in common.py - specifically errorheaders - errorresponse - generatehttperrorflask, which places ExceptionMessage into both response headers and the JSON body. The WebUI client then injects that text into the DOM using unsafe methods (examples in lib/rucio/web/ui/static/.js such as rule.js, requestrule.js, listrules.js) with jQuery.html(...) or equivalent, enabling reflected XSS when an attacker-controlled value is included in an error message (e.g. account, attribute, scope). PoC 1) Reflected XSS via account parameter (browse or load URL in WebUI context): Server response (excerpt): XSS…
Recommended action: Upgrade to 39.3.1, 38.5.4 or 35.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated. Rucio server / daemons are not affected by this issue, it is isolated to the webui. Patches This issue is fixed in the 1.26.7 release of the rucio-webui. Workarounds Installation of the 1.25.7 webui release. The 1.25 and previous webui release lines are not affected by this issue. References https://github.com/rucio/rucio/issues/4928
Recommended action: Upgrade to 1.26.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.