Cordaware Bestinformed Web Application Authenticated Stored Cross-Site Scripting Vulnerability

An authenticated stored cross-site scripting vulnerability has been identified in the Cordaware Bestinformed Web application, specifically in version 6.2.3.1. This vulnerability arises from improper sanitization of user input, allowing authenticated attackers to inject JavaScript code into the sessions of other users. As a result, attackers could compromise the sessions of users with higher privileges, facilitating unauthorized access or actions.

Impact

Exploitation of this vulnerability allows for authenticated stored cross-site scripting, with the potential to hijack the sessions of other users on the server.

Remediation

Users can update to Cordaware Bestinformed Web Interface version 6.2.2.5, which addresses this vulnerability. After this version, the session logic has been improved with enhanced security mechanisms.