SYNC-2021-072301 - JavaScript Injection Vulnerability in WebHelp Output

Severity: Medium2021-08-25

Abstract

There is a JavaScript injection vulnerability in WebHelp output. Using XSS attack, an attacker may inject Javascript code by typing specific expression in search field. This exploit requires a user to be tricked into executing malicious code, by searching for specific text.

Affected Products/Versions

Product	Severity	Fixed Release Availability
Oxygen XML WebHelp 23.1 and older versions	Medium	Oxygen XML WebHelp 23.1 build 2021090310 Oxygen XML WebHelp 22.1 build 2021082006
Oxygen Publishing Engine 23.1 and older versions	Medium	Oxygen Publishing Engine 23.1 build 2021082101 Oxygen Publishing Engine 22.1 build 2021082009
Oxygen XML Editor 23.1 and older versions	Medium	Oxygen XML Editor 23.1 build 2021082307 Oxygen XML Editor 22.1 build 2021082013
Oxygen XML Developer 23.1 and older versions	Medium	Oxygen XML Developer 23.1 build 2021082307 Oxygen XML Developer 22.1 build 2021082013
Oxygen XML Author 23.1 and older versions	Medium	Oxygen XML Author 23.1 build 2021082307 Oxygen XML Author 22.1 build 2021082013

Mitigation

None

Detail

SYNC-2021-072301

Severity: Medium

CVSS Score: 5.5

Oxygen XML WebHelp output is vulnerable to cross-site scripting. This vulnerability allows users to inject arbitrary JavaScript code in the WebHelp output thus altering the intended functionality.

To fix this vulnerability, you need to:

Update your products to a non-vulnerable version.
Replace the WebHelp outputs that were previously generated using one of the affected products with freshly generated ones.

The vulnerability has been fixed in version 22.1 starting with build 2021082013 and version 23.1 starting with build 2021082307.