Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Summary
Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Original description
The description as published by the source.
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a , allowing a ... breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov