| शीर्षक | OpenXE Org OpenXE 1.12 Improper Neutralization of Alternate XSS Syntax |
|---|
| विवरण | Cross Site Scripting in OpenXE v1.12
A low-level user with access to the ticket system can create a ticket containing an XSS payload that has the possibility of taking a higher user's cookie. ]
The vendor claims it to be a low risk and that they might (not) fix it in the future:
--- Vendor response below
Yes we checked it, we consider this a very low risk thing because the ticket system is used only internally. Will maybe be fixed the next time someone does work on this module.
--- End of vendor response
The advisory below is with a simple PoC that will send the cookie to an attacker's IP.
|
|---|
| स्रोत | ⚠️ https://www.singto.io/pocsforexploits/openxe/openxe-xss-ticket.html |
|---|
| उपयोगकर्ता | Jelle Janssens (UID 81048) |
|---|
| सबमिशन | 28/02/2025 09:26 AM (2 साल पहले) |
|---|
| संयम | 09/03/2025 08:00 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 299050 [OpenXE तक 1.12 Ticket Bearbeiten Page Notizen क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|