| タイトル | a466350665 Smart-SSO <=2.1.1 Incomplete Denylist to Cross-Site Scripting |
|---|
| 説明 | ### Introduction
[Smart-SSO](https://github.com/a466350665) is a lightweight, high-availability Single Sign-On (SSO) authentication and authorization center built on **SpringBoot** and **OAuth2** protocol with **RBAC** (Role-Based Access Control) permission design.
Stored XSS vulnerabilities allow attackers to permanently store malicious scripts on the target server. When other users visit the affected page, the malicious script is executed.
### Affected Versions
Smart-SSO 2.1.1 and earlier |
|---|
| ソース | ⚠️ https://www.notion.so/Smart-SSO-Stored-Cross-Site-Scripting-XSS-in-Role-Edit-Page-303ea92a3c4180f4beb9c119653ce51d |
|---|
| ユーザー | din4 (UID 50867) |
|---|
| 送信 | 2026年02月11日 02:24 (8 月 ago) |
|---|
| モデレーション | 2026年02月22日 09:16 (11 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 347339 [a466350665 Smart-SSO 迄 2.1.1 Role Edit Page UserController.java save クロスサイトスクリプティング] |
|---|
| ポイント | 17 |
|---|