CyberRota Analysis
AI-GeneratedA stored Cross-Site Scripting (XSS) vulnerability in the announcement preview component of REBUILD 4.4.3 allows an attacker to inject arbitrary JavaScript into the browsers of users viewing affected pages, including the dashboard and login page. This occurs due to improper handling of HTML escaping, where client-side code reverses the escaping, making it possible for malicious content to execute. Organizations using this version of REBUILD should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.