Executive brief
ids-enterprise is a JavaScript UI library for building enterprise applications. A cross-site scripting vulnerability in the soho-dropdown component allows attackers to inject and execute arbitrary JavaScript code if the component is used with untrusted input. This could enable attackers to steal user credentials, perform unauthorized actions, or redirect users to malicious sites.
Technical details
The vulnerability is a stored or reflected cross-site scripting (XSS) flaw (CWE-79) in the soho-dropdown component of ids-enterprise. The component fails to properly encode output, allowing attackers to inject arbitrary JavaScript that will be executed when the dropdown is rendered. The attack vector is network-based and requires the component to be instantiated with attacker-controlled input. No authentication is required if the vulnerable component is exposed in a public-facing interface. Attackers can achieve arbitrary JavaScript execution in the victim's browser, potentially leading to session hijacking, credential theft, or malware injection. The vulnerability was patched in version 4.18.2; users should upgrade immediately.
Affected products
- Infor ids-enterprise prior to 4.18.2
Timeline
- 2019-06-13: disclosed
- 2019: patched: Fixed in version 4.18.2