Advisory Weakness Curation

Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter ### Impact A reflected cross-site scripting vulnerability has been identified in Goobi viewer core when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. ### Patches The vulnerability has been fixed in version 23.03 ### Credits We would like to thank RUS-CERT https://cert.uni-stuttgart.de/ for reporting this issues. If you have any questions or comments about this advisory: * Email us at [support@intranda.com](mailto:support@intranda.com)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.