title: XSS vulnerability, eg for String properties.
description: Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
vendor: Apache Software Foundation
product: Apache Isis
versions:
version: unspecified, lessThan: 2.0.0-M9, status: affected, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'important'}
]