Tryton sao Cross-Site Scripting Vulnerability in Attachment Handling
Vulnerability
A stored cross-site scripting vulnerability has been identified in Tryton sao versions prior to 7.6.9. This issue allows authenticated users to upload HTML attachments that execute embedded JavaScript when previewed. The vulnerability could lead to session hijacking and unauthorized actions within the application.
Impact
Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the affected user's session, potentially leading to session theft, account takeover, and unauthorized actions within the application.
Reproduction
To reproduce this vulnerability, upload an HTML file as an attachment in Tryton sao. The file can contain JavaScript payloads, which will execute when the attachment is previewed. This can be done by any authenticated user.
Remediation
Users are advised to upgrade to Tryton sao versions 7.6.9, 7.4.19, 7.0.38, or 6.0.67.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.