Unblu Spark
Monthly
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.