GROWI Cross-Site Scripting Vulnerability in Page Alert Function

A cross-site scripting vulnerability has been identified in GROWI versions through 4.2.7. This issue arises in the page alert function, where user input is improperly sanitized, allowing attackers to execute arbitrary JavaScript in the context of the user's browser. The vulnerability is triggered by accessing a crafted URL while logged into the application.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute scripts in the victim's browser session.

Remediation

Users are advised to update GROWI to version 4.2.8 or later. The updated version can be downloaded from GitHub or Docker Hub.