Headline
CVE-2022-2510: Security:Security Advisories/BSSA-2022-01 - BlueSpice Wiki
Cross-site Scripting (XSS) vulnerability in “Extension:ExtendedSearch” of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Special:SearchCenter", using the search term in the URL.
Date
2022-01-31
Severity
Medium
Affected
BlueSpice 3.x, BlueSpice 4.x
Fixed in
BlueSpice 3.2.9, BlueSpice 4.1.1
Problem
Users are able to inject arbitrary HTML (XSS) on Special:SearchCenter, using the search term. This can be triggered via URL.
Solution
Upgrade to BlueSpice 4.1.1
Acknowledgements
Special thanks to the security team of an undisclosed customer