Proget Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Konsola Proget, specifically in the server component of the Proget Mobile Device Management (MDM) suite. This issue arises from improper sanitization of input in the comments section, allowing high-privileged users to inject malicious scripts that are executed when the comments are viewed. All versions of Proget prior to 2.17.5 are vulnerable.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the comments.

Remediation

Users can upgrade to Proget version 2.17.5 or later to address this vulnerability.