Ship Property Management System
Monthly
Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.