Critical · published October 12, 2023
CVSS calls it critical at 10.0. It sits in the 99.4th percentile for exploit probability.
🔥 A simple title change in the Change Request application can let anyone execute malicious scripts and gain full control! Think of it like a restaurant where anyone can send in a fake order and the kitchen prepares it without checking first—chaos ensues! An attacker could easily inject harmful scripts and execute remote code, potentially compromising the entire system. This could lead to unauthorized access, data breaches, or even complete takeover of the server. If unaddressed, this vulnerability could result in absolutely devastating consequences for users and their data.
Think of it like a restaurant where anyone can send in a fake order and the kitchen prepares it without checking first—chaos ensues! In versions 0.11 to 1.9.2 of Change Request, the application allows users to perform script injection and remote code execution by simply crafting a specific title during a Change Request. This lack of proper authorization checks is what makes it so critical.
An attacker could easily inject harmful scripts and execute remote code, potentially compromising the entire system. This could lead to unauthorized access, data breaches, or even complete takeover of the server. If unaddressed, this vulnerability could result in absolutely devastating consequences for users and their data. Immediately upgrade to Change Request version 1.9.2 to patch this vulnerability. If upgrading is not possible right away, you can edit the document `ChangeRequest.Code.ChangeRequestSheet` to apply a temporary fix as outlined in the fix commit. Don't delay—this one is urgent! You've got this! Follow these steps and you'll be fending off attackers like a pro. 🛡️