This vulnerability (CWE-79) in Delinea Secret Server (On-Prem) arises from improper neutralization of input during web page generation, enabling cross-site scripting attacks. The flaw allows an attacker to craft malicious links that, if used by legitimate users, execute arbitrary JavaScript in their browsers. The affected versions are from 10.2.19 up to and including 11.9.48. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided in the input.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session with the Secret Server application. This may result in theft of session tokens, unauthorized actions performed on behalf of the user, or other malicious activities impacting confidentiality, integrity, and availability of the application data. The vulnerability requires user interaction (clicking a malicious link) but does not require attacker privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links and consider applying any recommended workarounds from Delinea. Monitor the vendor's security advisories for updates and patches addressing this vulnerability.