OpenAtlas Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). This vulnerability arises from insufficient validation of user input in POST requests, specifically through the '/insert/group' endpoint using the 'name' and 'alias-0' parameters. Exploitation of this vulnerability could allow a remote user to send specially crafted queries to an authenticated user, potentially leading to the theft of their session cookie details.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to OpenAtlas version 8.10.1, which addresses this vulnerability. The updated version is available on the OpenAtlas GitHub repository.