ObjectPlanet Opinio 7.6.3 Cross Site Scripting

`Vendor: ObjectPlanet  
  
Product: Opinio  
  
Version: Up to 7.6.3 (inclusive)  
  
Homepage: http://www.objectplanet.com/opinio/  
  
CVE: CVE-2017-10798  
  
  
  
Description  
  
================  
  
Reflected XSS vulnerability in ObjectPlanet Opinio up to version 7.6.3.  
  
  
  
Vulnerability  
  
================  
  
The /admin/reportPortal.do page is vulnerable to reflected XSS attacks through the userLanguage GET parameter. This page is available to remote, unauthenticated users.  
  
  
  
Proof of concept  
  
================  
  
https://localhost/admin/reportPortal.do?userLanguage=%22%3E%3C/script%3E%3Cscript%3Ealert(1);//  
  
  
  
Mitigations  
  
================  
  
Upgrade to version 7.6.4 or later.  
  
  
  
References  
  
================  
  
https://gist.github.com/kasperkarlsson/da24c64a5b56ff20059e31f74b2a19ac  
  
http://www.objectplanet.com/opinio/changelog.html  
  
  
  
Timeline  
  
================  
  
2017-03-31 Vulnerability discovered  
  
2017-04-01 Asked vendor how they prefer to receive vulnerability reports  
  
2017-04-03 First response from vendor  
  
2017-04-04 PoC sent to vendor  
  
2017-04-05 Vendor confirms vulnerability. Patch will be included in next release within a few weeks.  
  
2017-04-20 Patch released in version 7.6.4 - "Improved: Fixed some cross-site scripting vulnerabilities." http://www.objectplanet.com/opinio/changelog.html  
  
2017-07-02 CVE Requested and received - "Use CVE-2017-10798."  
  
2017-07-09 Public disclosure  
  
  
  
Discovered by Kasper Karlsson  
  
  
`