Cross-Site Scripting (XSS) vulnerabilities in Neos
The advisory, in context
It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials (such as cookies). With the potential backdoor upload an attacker could gain access to the server itself, to an extent mainly limited by the server setup.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 1.2.0 before 1.2.13
Fixed in 1.2.13
13 explicitly affected versions
1.2.0, 1.2.1, 1.2.10, 1.2.11, 1.2.12, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.2.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.2.0",
"1.2.1",
"1.2.10",
"1.2.11",
"1.2.12",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.8",
"1.2.9"
]
}From 2.0.0 before 2.0.4
Fixed in 2.0.4
4 explicitly affected versions
2.0.0, 2.0.1, 2.0.2, 2.0.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0",
"2.0.1",
"2.0.2",
"2.0.3"
]
}