Περιγραφή
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application-s cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu-s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
CVSS 9.3EPSS 0.244%Κίνδυνος 0.95
Προβολή πηγής- Δημοσίευση
- 2026-07-22 13:16:38
- Επηρεαζόμενες εκδόσεις
- unknown
- Τύπος
- Άλλο
- Τελευταία τροποποίηση
- 2026-07-22 19:17:14
- Διάνυσμα
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X