Date 2022-01-31
Severity Medium
Affected BlueSpice 3.x, BlueSpice 4.x
Fixed in BlueSpice 3.2.9, BlueSpice 4.1.1
CVE CVE-2022-2510

Problem[edit | edit source]

Users are able to inject arbitrary HTML (XSS) on Special:SearchCenter, using the search term. This can be triggered via URL.

Solution[edit | edit source]

Upgrade to BlueSpice 4.1.1

Acknowledgements[edit | edit source]

Special thanks to the security team of an undisclosed customer

No categories assignedEdit

Discussions