Headline
CVE-2022-41611: Security:Security Advisories/BSSA-2022-03 - BlueSpice Wiki
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application.
Date
2022-11-15
Severity
Low
Affected
BlueSpice 4.x
Fixed in
BlueSpice 4.2.1
CVE
CVE-2022-41611
Problem[edit | edit source]
Users with admin rights are able to inject arbitrary HTML (XSS) into main navigation by editing a menu item.
Solution[edit | edit source]
Upgrade to BlueSpice 4.2.1
Acknowledgements[edit | edit source]
Found during an internal security audit.