Stored XSS in Johnson Controls FM Systems Employee

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Johnson Controls FM Systems Employee software. It allows an attacker to inject malicious scripts that are stored on the server and executed when other users view affected pages. The flaw exists in versions before 2025.3.1.

Useful 0 Not Useful 0

Detection Guidance

Detecting this stored XSS vulnerability requires manual inspection of web application inputs and outputs. Check user input fields in FM Systems Employee for improperly sanitized data. Look for stored payloads in application responses or database entries. Use browser developer tools to inspect DOM changes and network requests for suspicious scripts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or perform actions on behalf of users. It may lead to unauthorized data access or manipulation if users interact with the compromised pages.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing user data through session hijacking or script injection. For HIPAA, it may risk unauthorized access to protected health information if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FM Systems Employee to version 2025.3.1 or later. If upgrading is not possible, implement strict input validation and output encoding for all user-supplied data. Disable unnecessary user input fields and apply web application firewall rules to block XSS payloads. Monitor application logs for signs of exploitation.

Useful 0 Not Useful 0