BSSA-2022-07

Revision as of 16:21, 11 November 2022 by Mglaser (talk | contribs) (Created page with "{| class="wikitable" |+ ! ! |- |Date |2022-11-08 |- |Severity |Medium |- |Affected |BlueSpice 4.x |- |Fixed in |BlueSpice 4.2.1 |- |CVE |[https://www.cve.org/CVERecord?id=CVE-...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Date 2022-11-08
Severity Medium
Affected BlueSpice 4.x
Fixed in BlueSpice 4.2.1
CVE CVE-2022-416XX

Problem

Users with edit rights are able to inject arbitrary HTML (XSS) into a user's personal navigation by editing a menu item. This allows for targeted attacks

Solution

Upgrade to BlueSpice 4.2.1

Acknowledgements

Found during an internal security audit.

Retrieved from "https://en.wiki.bluespice.com/w/index.php?title=Security:Security_Advisories/BSSA-2022-07&oldid=5222"