| शीर्षक | Governikus GmbH & Co. KG AusweisApp (Desktop) 2.5.4 Cross Site Scripting |
|---|
| विवरण | This vulnerability is submitted by Governikus the vendor and maintainer of the AusweisApp. See: https://www.governikus.de/loesungen/kundenprojekte/ausweisapp/
The Governikus AusweisApp (Desktop) versions 1.10.0 through 2.5.4 contain a cross-site scripting vulnerability (CWE-79) in the processing of the ResultMessage contained in a StartPAOSResponse. An attacker can provide an activation link referencing a malicious eID-Server that returns a crafted ResultMessage. The value is inserted into HTML output without proper escaping of HTML metacharacters, allowing attacker-controlled script code to be executed in the user's browser. The vulnerability is fixed in version 2.5.5 by properly escaping HTML metacharacters before rendering the ResultMessage.
CVSS 4.0 Score: 5.1 - https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N |
|---|
| उपयोगकर्ता | governikus (UID 100539) |
|---|
| सबमिशन | 12/08/2026 04:55 PM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 07:26 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403403 [Governikus AusweisApp तक 2.5.4 StartPAOSResponse ResultMessage क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|