Threats tagged 'ghsa-jpv3-jpw2-64jf'

OpenRemote versions before 1.32.2 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with write:admin permissions can upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. These malicious files can then be accessed through an unauthenticated image retrieval endpoint that serves them with content types allowing script execution in the application's origin. This vulnerability has a medium severity rating and requires user interaction for exploitation.