Cross site scripting

2014-01-0214:59:00

PRIOn knowledge base

www.prio-n.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.3%

JSON

Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java.

CPENameOperatorVersion
projectforgele5.2
projectforgeeq5.1
projectforgeeq5.0

Name	Operator	Version
projectforge	le	5.2
projectforge	eq	5.1
projectforge	eq	5.0

References

www.securityfocus.com/bid/64632

github.com/micromata/projectforge-webapp/commit/5a6a25366491443b76e528a04a9e4ba26f08a83c

www.projectforge.org/jira/browse/PF-483

www.projectforge.org/pf-en/News