| Package | Affected versions | Patched versions |
|---|---|---|
| io.goobi.viewer:viewer-core | < 23.03 | 23.03 |
| goobi viewer core | < 23.03 | 23.03 |
A reflected cross-site scripting vulnerability has been identified in Goobi viewer core when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser.
The vulnerability has been fixed in version 23.03
We would like to thank RUS-CERT for reporting this issues.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free