Altium Enterprise Server HTML Injection Vulnerability Allowing Cross-Site Scripting

A HTML injection vulnerability has been identified in Altium Enterprise Server (AES) version 7.0.3, across all platforms. This vulnerability allows authenticated attackers to execute arbitrary JavaScript in the browsers of victims by using crafted HTML content. The issue arises from inadequate input sanitization, which fails to remove potentially harmful HTML before it is displayed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the affected content.