Description
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | REMS | ≤ 1.0.0 | — |
References
- https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b technical-description exploit
- REMS by OpsTree Product Page product
- VulnCheck Advisory: OpsTree REMS through 1.0.0 Stored XSS via Attachment Upload and Preview third-party-advisory