This vulnerability allows an attacker to construct a request that, if executed by another application user, results in the execution of attacker-supplied JavaScript code within that user's browser session. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 3.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with limited confidentiality impact and no integrity or availability impact.

Successful exploitation leads to execution of attacker-controlled JavaScript in the victim's browser session, potentially enabling actions such as session hijacking or UI manipulation. However, the CVSS score and vector indicate limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild at this time.

No patch or official fix information is provided. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted inputs and avoid executing suspicious requests. No vendor advisory states that no action is required or that the issue is already mitigated.