Cross-site scripting found in the translations folder menuIssue date: 27-10-2020
Affects versions: 14.2, 13.4, 12.6
Security Issue ID
Affected Product Version(s)
14.2.2 and all previous versions
This stored cross-site scripting was found in the translations folder menu. It uses the folder name and triggers in the translations folder menu. If a folder named “test”><svg/onload=alert(1)>” is created and then after clicking on “Translations”, the payload in the folder name “test”><svg...” will be executed. This vulnerability has been fixed in brXM 14.3.0, 13.4.4, and 12.6.11.
Customers are recommended to upgrade to the latest maintenance or minor releases as indicated above. This can be done by simply incrementing the version number of the parent POM for the implementation project.
Credit for discovering this issue
Thomas van Ruitenbeek