Malicious JavaScript can be inserted into the quick note portlet

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.1 EE SP3 (5.1.6), 5.2 EE SP1 (5.2.5)
• Fix Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP2 (5.2.6)
• Component/s: Application Security, Util > Quick Note
• Labels: None
• Environment: All

A cross site scripting (XSS) vulnerability exists with display field in the quick note portlet. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page. To address this issue display field is escaped before text is displayed.