Impact

By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object

Patches

Fixed in 3.1.1, 3.2.0

Workarounds

Edit the datamodel to force displaying the said relation as a "tab" instead of a "property" (tagset widget)

References

• Combodo N°6917

Credits

Huge thanks to Nguyễn Hữu Cường for reporting this.

For more information

If you have any questions or comments about this advisory:
Email us at itop-security@combodo.com