Cross site scripting

2022-10-1720:15:00

PRIOn knowledge base

www.prio-n.com

mitre caldera 4.1.0

stored xss

cross site scripting

app.contact.gist

arbitrary commands

agents

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.2%

JSON

MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.

CPENameOperatorVersion
calderalt4.1.0

CPE	Name	Operator	Version
	caldera	lt	4.1.0

References

github.com/metaredteam/external-disclosures/security/advisories/GHSA-7344-4pg9-qf45