Wolters Kluwer LEX Baza Dokumentów DOM-Based Cross-Site Scripting Vulnerability

A DOM-based cross-site scripting vulnerability has been identified in Wolters Kluwer LEX Baza Dokumentów, specifically within the 'em' cookie parameter. The application processes this parameter unsafely on the client side, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. While the ability to set a cookie could enable more severe attacks, the overall risk of exploitation is considered minimal. Nevertheless, the vendor acknowledged this issue and released a security patch, with the vulnerability fixed in version 1.3.4.

Impact

Exploitation of this vulnerability allows for DOM-based cross-site scripting, where an attacker can execute arbitrary JavaScript in the context of the victim's browser.

Remediation

Users are advised to update to version 1.3.4 or later, where this vulnerability has been addressed.