Malicious JavaScript can be inserted into the Plugins Configuration section of Control Panel

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP2 (5.2.6)
• Fix Version/s: 5.1 EE SP5 (5.1.8), 5.2 EE SP3 (5.2.7)
• Component/s: Application Security, Legacy > Control Panel menu, Legacy > Enterprise Admin
• Labels: None
• Environment: All

A cross site scripting (XSS) vulnerability exist which allow an attacker to insert malicious JavaScript into the Plugins Configuration section of Control Panel (or the Plugins of Enterprise Admin portlet in 5.1.7).