XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624 Yama
• github.com/…ommit/5b50c64c14943b6f4d7faf996345e603956bae1d Yama
• github.com/…ommons/security/advisories/GHSA-4vhv-49g2-496q Üçüncü taraf

Kayıt geçmişi

1. 2 Kas 2026 18:26Yayımlandı

İlgili açıklar

• 5,0 CVE-2026-120497Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
• 5,4 CVE-2026-119735Munshi XSS via Purchase Inquiry Thread Rendering
• 8,4 CVE-2026-111048FOSSBilling destek talebi notlarında depolanmış XSS açığı
• 6,1 CVE-2026-120500An Otter Wiki before 2.26.2 Stored XSS via Math Code Block
• 5,4 CVE-2026-120491Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
• 5,4 CVE-2026-120488LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content