CyberRota Analysis
AI-GeneratedThe Steedos Platform, up to version 3.0.15-beta.47, is vulnerable to a reflected cross-site scripting (XSS) flaw in the /api/page/render endpoint, which improperly escapes query parameters in inline scripts. This vulnerability allows attackers to create malicious links that can execute arbitrary JavaScript in user sessions, potentially leading to the theft of X-Auth-Token credentials. Organizations using this platform should prioritize patching to mitigate the risk of credential theft and session hijacking.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.