Northern.tech CFEngine Enterprise Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Northern.tech CFEngine Enterprise versions prior to 3.21.8, 3.24.3, and 3.27.0. This vulnerability arises from missing input sanitization in the Mission Portal, allowing for the injection of malicious JavaScript that could be executed when an affected user visits a page.

Impact

Exploitation of this vulnerability could allow an attacker to inject and execute malicious JavaScript in the context of another user, such as an admin, potentially leading to unauthorized actions or information disclosure.

Remediation

Users are advised to upgrade to CFEngine Enterprise versions 3.27.0, 3.24.3, or 3.21.8. Instructions for upgrading CFEngine can be found in the CFEngine documentation.