Mailing List Archive

Admin XSS security vulnerabilities fixed (CVE-2020-12685)
The Interchange admin in versions 4.7.0 through 5.11.x (before 2020-05-15)
was vulnerable to cross-site scripting (XSS) injection attacks in the help
and quicklinks pages.

Attackers could use browser JavaScript to steal client-side credentials
such as a session cookie or delivered page data. The attack type is
reflected XSS, active for a single page request via tainted link, not
stored in the database or in page files or reusably in the session.

This was found and reported by Sean Fernandez. Thank you very much!

It has been assigned the identifier CVE-2020-12685.

To resolve the problem, apply the patch from this commit:

Or download the new versions of the 2 corrected files:

curl --remote-name-all $u2/help.html $u2/quicklinks.html

Then copy them into place in your global admin installation:

cp help.html quicklinks.html /path/to/interchange/lib/UI/pages/admin/

If you made catalog-local copies to customize those files, you will need
to apply the fixes there manually in /path/to/catalog/pages/admin/ also.

Restarting the Interchange daemon is not necessary.

The nightly build now includes the fixes, as will the upcoming 5.12.0

This announcement is reposted from the website news area:


Jon Jensen
End Point Corporation
interchange-announce mailing list