Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenReplay HTML Injection vulnerability
Vulnerability Description
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
输入验证不恰当
Vulnerability Title
OpenReplay 安全漏洞
Vulnerability Description
OpenReplay是开发人员友好的、自托管的会话重播。 OpenReplay 1.14.0及之前版本版本存在安全漏洞，该漏洞源于缺少对Name field-Account Settings的验证，导致攻击者可以向受害者发送带有HTML注入代码的电子邮件。
CVSS Information
N/A
Vulnerability Type
N/A