What’s Vulnerable › Vulnerabilities

CVE-2024-28112: Cross site scripting on router page in Peering Manager

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-12 · updated 2026-06-17
• Weakness: CWE-79

Description

Peering Manager is a BGP session management tool. Affected versions of Peering Manager are subject to a potential stored Cross-Site Scripting (XSS) attack in the `name` attribute of AS or Platform. The XSS triggers on a routers detail page. Adversaries are able to execute arbitrary JavaScript code with the permission of a victim. XSS attacks are often used to steal credentials or login tokens of other users. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• peering-manager: before 1.8.3 — fixed in 1.8.3

How to fix

Upgrade to a fixed version: peering-manager 1.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/peering-manager/peering-manager/security/advisories/GHSA-fmf5-24pq-rq2w
• https://owasp.org/www-community/attacks/xss
• https://github.com/peering-manager/peering-manager/security/advisories/GHSA-fmf5-24pq-rq2w
• https://owasp.org/www-community/attacks/xss

Get alerted when CVE-2024-28112 or the next vulnerability affects your stack