OpenAtlas Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in OpenAtlas version 8.9.0, developed by the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). This vulnerability arises from insufficient validation of user input in POST requests, specifically through the '/insert/event' endpoint and the 'name' parameter. As a result, a remote user could craft queries to an authenticated user, potentially stealing their session cookie details.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to OpenAtlas version 8.10.1, which addresses this vulnerability. The updated version is available on the OpenAtlas GitHub repository.