GHSA-5wmj-5x79-rr87: REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
Event History
Frequently Asked Questions
Who can exploit this issue, and whose session is at risk?
A content editor who can submit crafted values through the affected media, medialist, link, or linklist widgets can exploit it. The injected script executes in an administrator's backend session, which can enable account hijacking.
Which inputs should be prioritized when assessing exposure?
Prioritize uses of REX_INPUT_MEDIA and REX_INPUT_LINK, including the media, medialist, link, and linklist widgets that render their stored values. The flaw occurs when crafted stored values break out of an HTML value attribute.
What versions are affected?
REDAXO versions before 5.21.4 are affected. Upgrading to 5.21.4 or later addresses the affected version range described in the advisory.