The vulnerability in ci4ms (versions before 0.31.4.0) involves improper neutralization of input during web page generation (CWE-79). Specifically, the blacklist note parameter is stored unsanitized and rendered without escaping in an HTML data attribute, enabling stored cross-site scripting. An admin with blacklist privileges can inject malicious JavaScript that executes in other admins' browsers when they access the user management interface. This can lead to limited confidentiality and integrity impacts within the administrative context. The issue is addressed by the vendor in version 0.31.4.0.

An attacker with admin privileges to the blacklist functionality can inject arbitrary JavaScript code that executes in the browsers of other admins viewing the user management page. This can lead to partial compromise of admin session confidentiality and integrity. There is no indication of availability impact or exploitation in the wild. The impact is limited to admins with specific privileges and does not affect general users.

This vulnerability is fixed in ci4ms version 0.31.4.0. Users should upgrade to version 0.31.4.0 or later to remediate the issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated beyond the fix in 0.31.4.0, so verify with the vendor advisory for the latest guidance.