<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Date: 14 Jun 2019<br>
Severity: Low (CVSS 3.7)<br>
Affected versions: all released midPoint versions since 3.7<br>
Fixed in versions: 4.0 (unreleased), 3.9.1 (unreleased), 3.8.1
(unreleased), 3.7.3 (unreleased)<br>
<br>
Description<br>
<br>
Cross-site scripting (XSS) vulnerability exists in some parts of
midPoint user interface, namely in organization displayName.<br>
<br>
Severity and Impact<br>
<br>
Malicious user can execute arbitrary scripts (e.g. Java Script) as
part of midPoint web-based user interface. This vulnerability exists
in displayName for all multi-value containers, including name of the
organization/organizational unit. Exploiting this vulnerability
requires administrative privileges, therefore severity and impact of
this vulnerability is low.<br>
<br>
Mitigation<br>
<br>
Users of affected MidPoint versions are advised to upgrade their
deployments to the latest builds from the support branches.<br>
As this is a low severity issue, it is not forcing official
maintenance releases of midPoint. However, the fix is provided in
all the support branches.<br>
<br>
Discussion and Explanation<br>
<br>
MIdPoint user interface is based on Apache Wicket web framework.
Proper use of Wicket web framework protects against most XSS-related
vulnerabilities. However, one part of midPoint code was using the
Wicket framework improperly, therefore opening XSS vulnerability.
The vulnerability could be exploited by fabricating displayName of
organizational unit, or in fact any display name of a multi-value
container.<br>
<br>
Credit<br>
<br>
This issue was reported by tester known as <span
class="mini-profile__name spec-mini-profile-name">Jespert123</span>
by the means of EU-Free and Open Source Software Auditing
(EU-FOSSA2) project.<br>
<br>
See Also<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+XSS+Vulnerability+In+displayName">https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+XSS+Vulnerability+In+displayName</a><br>
<br>
<pre class="moz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>