title: Potential XSS on user preferences page
description: Cross-site Scripting (XSS) vulnerability in BlueSpiceAvatars extension of BlueSpice allows logged in user to inject arbitrary HTML into the profile image dialog on Special:Preferences. This only applies to the genuine user context.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: affected
product: BlueSpice
vendor: Hallo Welt! GmbH
versions:
lessThanOrEqual: 4.3.2, status: affected, version: 4, versionType: major
lessThanOrEqual: 3.2.10, status: affected, version: 3, versionType: major
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL