BSSA-2022-01

Revision as of 11:54, 24 March 2022 by Mglaser (talk | contribs) (Created page with "{| class="wikitable" |+ ! ! |- |Date |2022-01-31 |- |Severity |Medium |- |Affected |BlueSpice 4.x |- |Fixed in |BlueSpice 4.1.2 |} == Problem == Users are able to inject arbi...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Date 2022-01-31
Severity Medium
Affected BlueSpice 4.x
Fixed in BlueSpice 4.1.2

Problem

Users are able to inject arbitrary HTML (XSS) on Special:SearchCenter, using the search term. This can be triggered via URL.

Solution

Upgrade to BlueSpice 4.1.2

Acknowledgements

Special thanks to the security team of an undisclosed customer

Retrieved from "https://en.wiki.bluespice.com/w/index.php?title=Security:Security_Advisories/BSSA-2022-01&oldid=2954"