XSS on admin settings

[zachi40 0]

We just noticed an XSS vulnerability when I change the device name to XSS payload

I am at version: 4.6.7.0

Has this already been fixed?

 

And at url "<embyserver>/web/web/1<XSS payload>"

Edited February 8, 2022 by zachi40
find more places

[Abobader 3464]

Hello zachi40,

** This is an auto reply **

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[Luke 42077]

Hi, where did you change the device name to xss payload?

[zachi40 0]

3 hours ago, Luke said:

Hi, where did you change the device name to xss payload?

yes

[Luke 42077]

Hi, where did you do this?

[zachi40 0]

1 minute ago, Luke said:

Hi, where did you do this?

I change my iPhone name to "><img src="x" onerror=alert(1)>" .

Then I go to the Admin page (<EMBY>/web/index.html#!/dashboard) ) and XSS is run

[Luke 42077]

OK we'll take a look at it. Thanks.