Malicious JavaScript can be inserted into the Directory portlet

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.2 EE (5.2.4)
• Fix Version/s: 5.2 EE SP1 (5.2.5)
• Component/s: Application Security, Social Networking > Directory
• Labels:
  • 5.2_release_notes
• Environment: All

A cross site scripting (XSS) vulnerability exist with the job title field in the Directory portlet. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page.

To address this issue, job titles are now escaped before they are displayed on a page.