Security readout for executives and security teams
Plain-English summary
OpenMediaVault 2.1 had multiple web UI scripting flaws in user management. An attacker could cause malicious script to run in a logged-in user's browser. The sources do not show active exploitation, severity scoring, or broad version impact.
Executive priority
Treat as a legacy management-interface risk. Prioritize if OpenMediaVault 2.1 remains in service, especially where the admin UI is reachable beyond trusted administrators.
Technical view
The CVE describes multiple XSS issues in rpc.php within OpenMediaVault 2.1 Access Rights Management Users. Injected script can execute in an authenticated client browser. Public metadata lacks CVSS, CWE, detailed vulnerable parameters, and confirmed fixed release information.
Likely exposure
Likely limited to OpenMediaVault release 2.1 instances where the management interface and user-management functionality are accessible. The source bundle does not confirm other affected versions or deployment conditions.
Exploitation context
CISA KEV is false, and the provided sources do not claim active exploitation. Exploitation would require a path to inject script and have an authenticated client render it, but details are incomplete.
Researcher notes
Evidence is sparse: one CVE description and one upstream commit reference. Do not assume unauthenticated exploitation, RCE, or additional affected versions without vendor confirmation.
Mitigation direction
- Review OpenMediaVault vendor guidance and the referenced upstream commit.
- Upgrade away from OpenMediaVault 2.1 if still deployed.
- Restrict management UI access to trusted administrative networks.
- Review user-management data for unexpected script-like content.
Validation and detection
- Inventory OpenMediaVault versions and identify any 2.1 systems.
- Confirm whether rpc.php user-management code includes the referenced fix.
- Check access controls around the management interface.
- Review web logs for suspicious user-management activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-1000065 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openmediavault/openmediavault/commit/b2db1e24d0e52b961b5c3b3329b6ee717cac53a2CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.