Stored XSS in Audit Log via Malicious Usernames

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue that occurs by using usernames as an attack vector. Specifically, when an administrator views the audit log details for affected entries, any malicious JavaScript code embedded within a username is executed because the output is not properly sanitized or escaped.

The problem arises from missing output sanitisation in the audit log details, allowing the malicious script to run in the admin's browser context.

The issue has been addressed by adding proper escaping to the audit log details output to prevent execution of malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of an administrator's browser when they view audit log details.

This could potentially lead to unauthorized actions performed by the admin user unknowingly, such as session hijacking, data theft, or manipulation of the admin interface.

However, the CVSS base score is 0.0, indicating that the vulnerability may have limited impact or requires specific conditions to be exploited.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that proper output sanitisation or escaping is applied to usernames displayed in audit log details, especially when viewed by admin users.

Review and update your system or application to include the patch or fix that adds proper escaping to the audit log details output.

Useful 0 Not Useful 0