Description (CNA)
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NationalSecurityAgency / emissary | affected < 8.39.0 |
CWE
CWE-79
References
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp
- https://github.com/NationalSecurityAgency/emissary/pull/1293
ADP enrichment
No English description supplied.
No references supplied.