GHSA-rff7-964g-pppx

The Reporting Addon for CUBA Platform has Persistent XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-20663

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.haulmont.cuba:cuba-web-toolkit	>= 6.10.0, < 6.10.7	6.10.7
Maven	com.haulmont.cuba:cuba-web-toolkit	>= 6.9.0, < 6.9.8	6.9.8
Maven	com.haulmont.cuba:cuba-web-toolkit	< 6.8.15	6.8.15

Details

As written in the advisory (Markdown source, shown as plain text).

The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20663 advisory
https://github.com/cuba-platform/cuba/issues/1741 web
https://github.com/cuba-platform/reports/issues/140 web
https://github.com/cuba-platform/cuba/commit/be6aa41ff36a365e2a995d37861e5acfcd32c2c5 web
https://github.com/cuba-platform/cuba/commit/e9f972beeae42dc6dbc3aaa6b6ecc9814c0eedb4 web
https://github.com/cuba-platform/cuba/commit/ec8784d8f596aa570604f4e5d5d4a7c3ae264c62 web
https://github.com/cuba-platform/reports package