JVN#18501376: OpenPNE vulnerable to cross-site scripting

The management screen in OpenPNE contains an issue in the processing of data input into the “mobile version color scheme configuration” item, which may result in a cross-site scripting vulnerability.

Impact

An arbitrary script may be executed on the web browser of a user who is logged on as an administrator.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• OpenPNE 3.4.21 and earlier
• OpenPNE 3.6.9 and earlier
• OpenPNE 3.8.5 and earlier