Difference between revisions of "Security:Security Advisories/BSSA-2022-02"

[unchecked revision][quality revision]
m ((username removed) (log details removed))
m ((username removed) (log details removed))
 

Latest revision as of 12:06, 26 April 2022

Date 2022-04-25
Severity Medium
Affected BlueSpice 4.x
Fixed in 4.1.3

Problem

Users are able to inject arbitrary HTML (XSS) on regular pages, using a special value for the title parameter. This can be triggered via URL.

Solution

Upgrade to BlueSpice 4.1.3

Acknowledgements

Special thanks to the security team of an undisclosed customer

No categories assignedEdit

Discussions

Attachments