OCS Inventory NG Server Stored Cross-Site Scripting Vulnerability via User-Agent

A stored cross-site scripting vulnerability has been identified in OCS Inventory NG Server versions through 2.12.3. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript by sending malicious User-Agent HTTP headers to the /ocsinventory endpoint. The injected scripts are stored without proper sanitation and are displayed with inadequate encoding in the web console. This leads to the execution of arbitrary JavaScript in the browsers of authenticated users who are viewing the statistics dashboard.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the statistics dashboard.

Remediation

Users can update to the latest version of OCS Inventory NG Server to address this vulnerability.