BSSA-2022-01

Revision as of 12:54, 24 March 2022 by Mglaser (talk | contribs) (Created page with "{| class="wikitable" |+ ! ! |- |Date |2022-01-31 |- |Severity |Medium |- |Affected |BlueSpice 4.x |- |Fixed in |BlueSpice 4.1.2 |} == Problem == Users are able to inject arbi...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Date 2022-01-31
Severity Medium
Affected BlueSpice 4.x
Fixed in BlueSpice 4.1.2

1. Problem

Users are able to inject arbitrary HTML (XSS) on Special:SearchCenter, using the search term. This can be triggered via URL.

2. Solution

Upgrade to BlueSpice 4.1.2

3. Acknowledgements

Special thanks to the security team of an undisclosed customer

Retrieved from "https://en.wiki.bluespice.com/w/index.php?title=Security:Security_Advisories/BSSA-2022-01&oldid=2954"
No categories assignedEdit

Discussions