Aller au contenu
en Se connecter
7.3 Élevée

CVE-2026-18481 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an…

Description

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.

Produits et versions touchés

Produit Versions touchées Corrigé en
AWS Ops Wheel Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de AWS Ops Wheel

Les 3 CVE de AWS Ops Wheel →
CVE-2026-6912 Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in… 8.8 Élevée CVE-2026-6911 Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain… 9.8 Critique
Suivre cette CVE