{"id":"GHSA-rq7f-j68f-mqh3","aliases":["CVE-2024-5312"],"title":"PHP Server Monitor vulnerable to Cross-site Scripting","description":"PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details.","severity":"medium","score":6.3,"published":"2024-05-24T18:45:28.000Z","modified":"2024-05-24T19:41:53.163Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpservermon/phpservermon","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.3.0"}],"type":"ECOSYSTEM"}],"versions":["v3.1.0","v3.1.1","v3.2.0","v3.2.0-rc1","v3.2.1","v3.2.2"],"fixed":["3.3.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-5312","https://github.com/PHPMailer/PHPMailer/commit/ff8718f72225a2e34d918c06a3b2c8cca5af3164","https://github.com/phpservermon/phpservermon","https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor"],"sources":[{"name":"OSV","id":"GHSA-rq7f-j68f-mqh3","modified":"2024-05-24T19:41:53.163393Z","url":"https://osv.dev/vulnerability/GHSA-rq7f-j68f-mqh3"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","score":6.3}]}