Ausweisapp
Monthly
Cross-site scripting in Governikus AusweisApp through version 2.5.4 lets a remote attacker plant script through the ResultMessage argument handled by the StartPAOSResponse component, so that attacker-influenced content is rendered instead of plain result text. The flaw is network-reachable with no privileges required, but the user must be engaged in an eID flow before the malicious response is processed. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the vendor has released version 2.5.5 as the fix.
Cross-site scripting in Governikus AusweisApp through version 2.5.4 lets a remote attacker plant script through the ResultMessage argument handled by the StartPAOSResponse component, so that attacker-influenced content is rendered instead of plain result text. The flaw is network-reachable with no privileges required, but the user must be engaged in an eID flow before the malicious response is processed. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the vendor has released version 2.5.5 as the fix.