This vulnerability involves improper neutralization of input during web page generation in migration-planner. Specifically, the AgentStatusUpdate.CredentialUrl field does not properly validate input, allowing an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it triggers cross-site scripting (XSS), enabling script execution in the victim's session. This can lead to unauthorized code execution and disclosure of sensitive information such as session cookies. Red Hat's advisory states that no currently supported Red Hat products are affected by this issue.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the context of the victim's session within the Hybrid Cloud Console. This can lead to disclosure of sensitive information, including session cookies, potentially compromising user accounts. The vulnerability has a CVSS 3.1 base score of 6.3 (medium severity), indicating a moderate impact on confidentiality and integrity but no impact on availability. There are no known exploits in the wild.

Red Hat has determined that this vulnerability does not affect any currently supported Red Hat products, so no action is required for those users. For affected versions of migration-planner prior to 0.13.6, users should consult the vendor or project maintainers for patches or updates addressing this issue. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.