5vulnerabilities
- Critical1 (20.0%)
- High4 (80.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
meshcentral
Ecosystem: npm
Downloads: 67.39 K
- 1CriticalAffects 1 version
- 4HighAffects 4 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting meshcentral, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-c7hr-448w-65px | High | MeshCentral has unsanitized data fields### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted. ### Technical Details ```j |
| GitHub (opens in a new tab) | |
| GHSA-cp68-qrhr-g9h8 | High | MeshCentral cross-site websocket hijacking (CSWSH) vulnerabilityWe have identified a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint of MeshCentral. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. To demonstrate the impact of the vulnerability we developed a proof-of-concept which leveraged the cross-site websocket hijacking vulnerability to read the server configuration file to leak the sessionKey variable, generating login tokens, and generating an authentication cookie. The vulnerability is exploitable when an attacker is able to convince a victim end |
| GitHub (opens in a new tab) | |
| GHSA-v269-rrr6-cx6r | High | Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm. |
| GitHub (opens in a new tab) | |
| GHSA-8xw6-9h78-c89j | Critical | Ylianst MeshCentral Missing SSL Certificate ValidationYlianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation. |
| GitHub (opens in a new tab) | |
| GHSA-wpxw-5xfm-x22v | High | MeshCentral algorithm-downgrade issueAn algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16. |
| GitHub (opens in a new tab) |
### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted. ### Technical Details ```j
- GHSA-cp68-qrhr-g9h8HighMeshCentral cross-site websocket hijacking (CSWSH) vulnerability
< 1.1.21
We have identified a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint of MeshCentral. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. To demonstrate the impact of the vulnerability we developed a proof-of-concept which leveraged the cross-site websocket hijacking vulnerability to read the server configuration file to leak the sessionKey variable, generating login tokens, and generating an authentication cookie. The vulnerability is exploitable when an attacker is able to convince a victim end
CVE: CVE-2024-26135
- GHSA-v269-rrr6-cx6rHighYlianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
<= 1.1.16
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
CVE: CVE-2023-51838
- GHSA-8xw6-9h78-c89jCriticalYlianst MeshCentral Missing SSL Certificate Validation
<= 1.1.16
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.
CVE: CVE-2023-51837
An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
CVE: CVE-2023-51842