XSS in consent-text datacenter option
Affected packages
pve-manager, libpve-cluster-perl
Details
An incomplete definition of the consent-text field in the datacenter configuration schema allowed a highly privileged attacker to inject arbitrary content into the web UI index template.
This issue was reported privately by Alexander Wolf <[email protected]>.
Fixed in
- pve-manager >= 9.2.24
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.