Smart-SSO: Cross-Site Scripting in Role Edit Page

Summary

A security weakness in Smart-SSO versions up to 2.1.1 allows an attacker to inject malicious code into the system. This could lead to unauthorized access or malicious actions on the system. Update to version 2.1.2 or later to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
a466350665	smart-sso	<= 2.1.1	–

Original title

A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserControlle...

Original description

A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserController.java of the component Role Edit Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 3.3

nvd CVSS3.1 5.4

nvd CVSS4.0 4.8

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

CWE-94 Code Injection

https://vuldb.com/?ctiid.347339 Permissions Required VDB Entry
https://vuldb.com/?id.347339 Third Party Advisory VDB Entry
https://vuldb.com/?submit.756026 Third Party Advisory VDB Entry
https://www.notion.so/Smart-SSO-Stored-Cross-Site-Scripting-XSS-in-Role-Edit-Pag... Exploit Third Party Advisory