Overview
This advisory addresses a Stored XSS vulnerability in Verodin Director affecting version 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.
This issue was reported to and resolved by Verodin in accordance with responsible disclosure guidelines. The vulnerability was originally disclosed in the Verodin product release notes for version 3.5.4.0 (see section "Defects Resolved, Security").
Vulnerability Information
Definitions
CVE Common Vulnerabilities and Exposures is a dictionary of common names (CVE Identifiers) for publicly known information security vulnerabilities maintained by the MITRE Corporation.
CVSS Common Vulnerability Scoring System is a vendor agnostic, industry open standard designed to convey the severity of a vulnerability. CVSS scores may be used to determine the urgency for update deployment within an organization and can range from 0.0 (no vulnerability) to 10.0 (critical). Customers performing their own risk assessments of vulnerabilities that may impact them can benefit from using the same industry-recognized CVSS metrics.
Mitigations Mitigations are existing conditions that a potential attacker would need to overcome to mount a successful attack or that would limit the severity of an attack. Examples of such conditions include default settings, common configurations and general best practices.
Workarounds Workarounds are settings or configuration changes that a user or administrator can apply to help protect against an attack.
Acknowledgements
(Screenshot from Verodin product release notes for version 3.5.4.0)
