Description
In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palantir | com.palantir.apollo:autopilot | < 3.308.0 | 3.308.0 |