OpenAtlas Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). This vulnerability arises from insufficient validation of user input in POST requests, allowing remote users to send specially crafted queries to authenticated users and potentially steal their session cookies. The vulnerability is associated with the '/insert/place' endpoint and involves the 'name' and 'alias-0' parameters.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to OpenAtlas version 8.10.1, which addresses this vulnerability.