Threats tagged 'ghsa-28p3-4q26-3xh2'

EdgeEver versions from 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to exploit the PUT /api/v1/restores/json/resources/:id endpoint by submitting a resource of kind image with a text/html MIME type without proper validation. Exploitation can lead to victim browsers executing malicious scripts that mint non-expiring API tokens, granting attackers read and write access to the victim's notes.