Threats tagged 'ghsa-pmxw-f2gq-hx4c'

REDAXO versions prior to 5.21.3 have a reflected cross-site scripting (XSS) vulnerability in the backend media pool detail page. The vulnerability arises because the opener_link parameter is rendered without proper HTML escaping. An unauthenticated attacker can trick logged-in backend users with media permissions into clicking a crafted link, allowing script injection. This script can read the victim's CSRF token and perform actions with their permissions, including potentially executing code via template or module edits if the victim has administrator privileges.