Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Since version 4.12.0, Dependency-Track users with the SYSTEMCONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Impact Users with the SYSTEMCONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. Patches The issue has been fixed in version 4.13.6. References The issue was introduced via: https://github.com/DependencyTrack/frontend/pull/986 The issue was fixed via: https://github.com/DependencyTrack/frontend/pull/1378 Credit Thanks to Jonas Benjamin Friedli for identifying and responsibly disclosing the issue.
Recommended action: Upgrade to 4.13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in), and versions before 4.6.1 of the Dependency-Track frontend did not encode or sanitize Showdown's output. This made it possible for arbitrary JavaScript included in vulnerability details via HTML attributes to be executed in context of the frontend. Impact Actors with the VULNERABILITYMANAGEMENT permission can exploit this weakness by creating or editing a custom vulnerability and providing XSS payloads in any of the following fields: Description Details Recommendation References The payload will be executed for users with the VIEWPORTFOLIO permission when browsing to the modified vulnerability's page, for example: Alternatively, malicious JavaScript could be introduced via any of the vulnerability databases mirrored by Dependency-Track (NVD, GitHub…
Recommended action: Upgrade to 4.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.