Potential XSS on default page header

Vulnerability

A stored Cross-site Scripting (XSS) vulnerability exists in the BlueSpiceDiscovery skin of BlueSpice. A logged-in user with edit permissions can inject arbitrary HTML into the default page header of a wiki page. The affected version is BlueSpice 4.x prior to 4.2.1 [1].

Exploitation

An attacker needs a valid account with edit permissions on the wiki. No additional privileges are required; the attacker can craft malicious HTML payloads and save them via the user preference interface, which then renders in the page header for other users [1].

Impact

Successful exploitation allows the attacker to inject arbitrary HTML or JavaScript into the context of the victim's browser session. This can lead to session hijacking, defacement, or phishing attacks within the BlueSpice environment, affecting confidentiality, integrity, and availability of user data [1].

Mitigation

BlueSpice has released a fixed version 4.2.1 that addresses this vulnerability. Users should upgrade to BlueSpice 4.2.1 or later. No workarounds are provided in the advisory [1].