Newforma Info Exchange Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in Newforma Info Exchange (NIX) Project Center versions prior to 2024.1. The issue arises in the 'Send a File Transfer' feature, which allows remote, authenticated attackers to upload SVG files containing JavaScript or other executable content. This uploaded content can be executed or rendered by a web browser, particularly when using a mobile user agent.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files are executed or rendered in a way that executes the embedded JavaScript, potentially leading to malicious actions being performed on behalf of the user.