Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A reflected cross-site scripting vulnerability has been identified in Goobi viewer core when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. Patches The vulnerability has been fixed in version 23.03 Credits We would like to thank RUS-CERT for reporting this issues. If you have any questions or comments about this advisory: Email us at support@intranda.com
Recommended action: Upgrade to 23.03 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. Patches The vulnerability has been fixed in version 23.03 If you have any questions or comments about this advisory: Email us at support@intranda.com
Recommended action: Upgrade to 23.03 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A cross-site scripting vulnerability has been identified in Goobi viewer core when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages. Patches The vulnerability has been fixed in version 23.03 If you have any questions or comments about this advisory: Email us at support@intranda.com
Recommended action: Upgrade to 23.03 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.