Thruk Monitoring Webinterface - Cross-Site Scripting

Author: pikpikcu,ritikchaddha Classification CWE-ID: CWE-79 CVSS-Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS-Score: 7.2 Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi. Reference - https://www.thruk.org/download.html - https://www.usd.de/en/security-advisory-thruk-monitoring-v2-46-3 Metadata max-request: 1 verified: true shodan-query: http.html:"Thruk"