XSS Vulnerabilities in Ibexa Admin UI - Security Advisory GHSA-5r6x-g6jv-4v87
Summary
GHSA-5r6x-g6jv-4v87: Ibexa Admin UI XSS vulnerabilities in back office. Affects ibexa/admin-ui versions >= 4.6.0-beta1, < 4.6.21. Fixed in 4.6.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ibexa Admin UI is a component of the Ibexa DXP (Digital Experience Platform) that provides a back office interface for content management and administration. It is designed for users with varying roles, such as Editors and Administrators, to manage digital content effectively. However, certain vulnerabilities have been identified that expose the platform to Cross-Site Scripting (XSS) attacks, particularly in the back office functionalities.
Vulnerability Detail
The identified vulnerabilities are classified as Cross-Site Scripting (XSS) issues that can be exploited by users with Editor or Administrator roles. These vulnerabilities allow an attacker to inject malicious scripts that can persist and be reflected in the front office, potentially affecting end users. The vulnerabilities stem from insufficient escaping of user input in the back office, which can lead to unauthorized script execution.
How To Fix
Minimum fixed version
4.6.21
This is the first release that contains the fix.
composer require ibexa/admin-ui:4.6.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The recommended action is to update to the patched version as soon as possible.
Conclusion
The XSS vulnerabilities in the Ibexa Admin UI pose a moderate risk to users with editing and administrative permissions. It is essential to update to the patched version 4.6.21 to ensure the security of the platform and protect end users from potential attacks.
See every vulnerability recorded for ibexa/admin-ui →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that allows for the injection of malicious scripts in the Ibexa Admin UI.
Users with Editor or Administrator roles in the Ibexa DXP back office are primarily affected, as they have the permissions necessary to exploit the vulnerabilities.
If exploited, the vulnerability can lead to unauthorized script execution, which may compromise user data and affect the integrity of the front office.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no workarounds available, it is crucial to prioritize updating to the patched version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for ibexa/admin-ui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
