CyberRota Analysis
AI-GeneratedThe vulnerability affects the HTML output formatter in Prowler versions prior to 5.37.0, allowing an attacker with the ability to modify resource tags to inject malicious HTML or JavaScript into generated reports. This could lead to cross-site scripting (XSS) attacks when another user views the report, potentially compromising user data or session integrity. Organizations using Prowler for cloud security should prioritize upgrading to version 5.37.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.