BSSA-2022-05

Revision as of 17:50, 11 November 2022 by Mglaser (talk | contribs)
Date 2022-11-08
Severity Low
Affected BlueSpice 4.x
Fixed in BlueSpice 4.2.1
CVE CVE-2022-42001

Problem

Users with edit rights are able to inject arbitrary HTML (XSS) into book navigation by editing a book chapter title.

Solution

Upgrade to BlueSpice 4.2.1

Acknowledgements

Found during an internal security audit.

Retrieved from "https://en.wiki.bluespice.com/w/index.php?title=Security:Security_Advisories/BSSA-2022-05&oldid=5225"
No categories assignedEdit

Discussions