Info Security

Cross-Site Scripting vulnerability in app4.cloud.appspace.com cloud software What is it? - Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Which URL is affected? - https://app4.cloud.appspace.com/console/#!/ext/library The severity of this issue? - An attacker can redirect a user to a malicious website or can steal session token(no 'http only' flag was set☺). In this application, an attacker can create a temporary page 'webpage.html' and using this link he can spread malicious JavaScript code. The victim will observe the domain name-app4.cloud.appspace.com, which is a genuine site and clicks the malicious link. This link can be used to spread malicious javascript or can be used for Phishing.