title: DOM based XSS Vulnerability in Apache Knox
description: When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
product: Apache Knox
vendor: Apache Software Foundation
versions:
lessThan: 1.6.1, status: affected, version: Apache Knox 1.x, versionType: custom
lessThan: Apache Knox 0.x*, status: affected, version: 0.12.0, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]
workarounds: 1.x users should upgrade to 1.6.1.
Unsupported versions of the 0.x line that include this issue are: 0.13.0, 0.14.0.
and these should upgrade to 1.6.1 as well.
1.0.0 and 1.1.0 are also Unsupported but affected and should upgrade to 1.6.1.