Eveo URVE Smart Office Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Eveo URVE Smart Office, affecting all versions prior to 1.1.24. The issue arises in the 'report problem' feature, where an attacker with a low-privileged account can upload an SVG file containing a malicious payload. This payload is executed when a victim accesses the URL of the uploaded resource, which is available to anyone without authentication.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded malicious payloads are executed when the resource is accessed.

Remediation

Users can upgrade to URVE Smart Office version 1.1.24 or later to address this vulnerability.