Описание
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
A reflected cross-site scripting (XSS) vulnerability was found in the Eclipse BIRT Report Viewer. Specifically, the __format parameter is not sufficiently sanitized, allowing JavaScript to be inserted in the URL. A remote attacker can exploit this flaw to execute JavaScript code within the context of the affected user.
Отчет
This flaw did not affect the versions of eclipse-birt as shipped with Red Hat Enterprise Linux 6, as they did not include the BIRT Viewer component.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | eclipse-birt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
EPSS
6.1 Medium
CVSS3