Potential XSS in history view

Vulnerability

A stored Cross-site Scripting (XSS) vulnerability exists in the BlueSpiceFoundation extension of BlueSpice versions 4.x prior to 4.2.1. Users with a regular account and edit permissions can inject arbitrary HTML into the history view of a wikipage [1].

Exploitation

An attacker needs a valid user account with edit permissions and the ability to modify a wiki page's content or its associated metadata. The injected HTML is stored in the page history and is rendered when the history view is loaded by a victim [1].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML (and potentially JavaScript) in the context of the victim's session, leading to information disclosure, session hijacking, or further account compromise [1].

Mitigation

The vulnerability is fixed in BlueSpice 4.2.1, released on 2022-11-15. All users should upgrade to this version. There is no known workaround for earlier releases [1].