DriveLock Operations Center Cross-Site Scripting Vulnerability Allowing Session Takeover

A cross-site scripting (XSS) vulnerability has been identified in DriveLock Operations Center (DOC) versions 25.1.2 and 25.1.4. This issue allows attackers to inject malicious scripts into the web interface, which can be executed in the context of the affected user. The exploitation of this vulnerability could lead to session hijacking and arbitrary code execution.

Impact

Exploitation of this vulnerability could result in session takeover and unauthorized code execution on behalf of the user.

Remediation

Users are advised to update to DriveLock version 25.1.5, which addresses this vulnerability. For optimal security, it is recommended to use the latest release of DriveLock.