It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.
Se detectó que el Token Processing Service (TPS) no sanea apropiadamente los ID de Token de la página "Activity", permitiendo una vulnerabilidad de tipo Cross Site Scripting (XSS) Almacenado. Un atacante no autenticado podría engañar a una víctima autenticada para que cree una actividad especialmente diseñada, que ejecutaría código JavaScript arbitrario cuando es visualizada en un navegador. Se cree que todas las versiones de pki-core son vulnerables.
It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser.
