Leica Web Viewer Aperio Eslide Manager Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Leica Web Viewer component of the Aperio Eslide Manager Application. This issue allows authenticated users to inject malicious JavaScript into the 'memo' field of project slides. The vulnerability is triggered when the memo field is hovered over, displaying a Microsoft Tool Tip that executes the injected JavaScript.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an authenticated user can execute malicious JavaScript in the context of the user's browser.