Headline
CVE-2022-42001: Security:Security Advisories/BSSA-2022-05 - BlueSpice Wiki
Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the book navigation.
Date
2022-11-15
Severity
Low
Affected
BlueSpice 4.x
Fixed in
BlueSpice 4.2.1
CVE
CVE-2022-42001
Problem[edit | edit source]
Users with edit rights are able to inject arbitrary HTML (XSS) into book navigation by editing a book chapter title.
Solution[edit | edit source]
Upgrade to BlueSpice 4.2.1
Acknowledgements[edit | edit source]
Found during an internal security audit.