CVE-2021-46355
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
OCS Inventory 2.9.1 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by manipulating the name of a device (e.g., a printer) on the victim's computer, replacing it with malicious code.
Risk Assessment
The risk involves the execution of malicious scripts in the browser of an administrator or other user viewing inventory data, potentially leading to session hijacking, data leakage, or further attacks.
Recommendation
It is recommended to immediately upgrade OCS Inventory to a version newer than 2.9.1 that includes a fix for the XSS vulnerability. Also consider input filtering and sanitization for device names.
Original NVD description (English source)
OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).