Executive brief
ids-enterprise is a UI component library used by web applications to build user interfaces. The modal (dialog box) component fails to properly sanitize user-supplied text in the title attribute, allowing attackers to inject and execute malicious JavaScript in the browser. This could enable account takeover, data theft, or defacement depending on the privileges of the affected user.
Technical details
This is a reflected or stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the modal component of ids-enterprise. The root cause is insufficient input sanitization on the title attribute, which allows attackers to inject arbitrary HTML/JavaScript that will execute in the victim's browser context. The vulnerability affects all versions prior to 4.18.2. Exploitation requires either injecting a malicious link or crafting a request that causes the vulnerable component to render unsanitized attacker-controlled data in the modal title. The fix is available in version 4.18.2 and later.
Affected products
- Infor ids-enterprise prior to 4.18.2
Timeline
- 2019-06-13: disclosed