Pixar's Tractor software, versions 2.2 and earlier, contains a stored cross-site scripting vulnerability

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Pixar Tractor versions 2.2 and earlier. The flaw resides in the node note field, where an authenticated user can input arbitrary JavaScript. This input is stored on the server and later displayed to any authenticated user who views information about the node. The vulnerability is classified as CWE-79 [1].

Exploitation

An attacker must be an authenticated Tractor user with the ability to add notes to nodes. The attacker submits crafted JavaScript (e.g., ``) into the note field. When another authenticated user (or the same user) views the node details, the stored script executes in the context of the victim's browser. No special network position other than normal application access is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browsers of other authenticated users. This can lead to website redirects, session cookie hijacking, social engineering, or other actions that the victim's session permits. Because the script is stored and shared, all users with access to the affected node are at risk [1].

Mitigation

Pixar released Tractor version 2.3 (build 1923604) to address the vulnerability. Affected users should upgrade to this version. No workarounds are documented for earlier releases, and no KEV listing has been published [1].