React Jhipster
Monthly
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.