BSSA-2022-01

Revision as of 15:23, 25 April 2022 by Redaktion (talk | contribs)
Date 2022-04-25
Severity Medium
Affected BlueSpice 4.x
Fixed in 4.1.3

Problem

Users are able to inject arbitrary HTML (XSS) on regular pages, using a special value for the <code>title</code> parameter. This can be triggered via URL.

Solution

Upgrade to BlueSpice 4.1.3

Acknowledgements

Special thanks to the security team of an undisclosed customer

Retrieved from "https://en.wiki5.bluespice.com/w/index.php?title=Security:Security_Advisories/BSSA-2022-01&oldid=3309"