CVE-2020-25139

Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631

Description An issue was discovered that allows Cross-Site Scripting (XSS) due to the possibility of injecting and storing malicious JavaScript code. This can occur via the la id variable to the "/syslog rules" URI for delete syslog rule, because of syslog rules.inc.php.

Recommendations For Observium Professional, Enterprise & Community version 20.8.10631, consider restricting access to the syslog rules.inc.php file and the /syslog rules URI to minimize the risk of exploitation. Avoid using the la id variable in the affected API endpoint until the issue is resolved.