Headline
CVE-2022-3893: Security:Security Advisories/BSSA-2022-06 - BlueSpice Wiki
Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.
Date
2022-11-15
Severity
Low
Affected
BlueSpice 4.x
Fixed in
BlueSpice 4.2.1
CVE
CVE-2022-3893
Problem[edit | edit source]
Users with admin rights are able to inject arbitrary HTML (XSS) into custom navigation by editing a menu item.
Solution[edit | edit source]
Upgrade to BlueSpice 4.2.1
Acknowledgements[edit | edit source]
Found during an internal security audit.