Cross-site scripting found in the translations folder menu 

Issue date: 27-10-2020
Affects versions: 14.2, 13.4, 12.6

Security Issue ID

SECURITY-171

 

Affected Product Version(s)
14.2.2 and all previous versions


Severity 

high


Description

This stored cross-site scripting was found in the translations folder menu. It uses the folder name and triggers in the translations folder menu. If a folder named  “test”><svg/onload=alert(1)>” is created and then after clicking on “Translations”, the payload in the folder name “test”><svg...” will be executed. This vulnerability has been fixed in brXM 14.3.0, 13.4.4, and 12.6.11.

Instructions

Customers are recommended to upgrade to the latest maintenance or minor releases as indicated above. This can be done by simply incrementing the version number of the parent POM for the implementation project.

Credit for discovering this issue

Thomas van Ruitenbeek

 

We rely on cookies

to optimize our communication and to enhance your customer experience. By clicking on the Accept and Close button, you agree to the collection of cookies. You can also adjust your preferences by clicking on Manage Preferences. For more information please see our Privacy policy.

Manage cookies
Accept & close

Cookies preferences

Accept & close
Back