Stored Cross Site Scripting (XSS) (at LicenseDataProvider.updateLicenseKey endpoint LicenseKey parameter) - CVE-2022-26976

Article number: [5631] - Legacy code: [12682]

Applicable to

Summary:

Barco Control Room Management Suite was discovered to be vulnerable to stored cross site scripting vulnerability due to a lack of input sanitizing at the license key parameter (LicenseDataProvider.updateLicenseKey endpoint).

Issue severity

Medium

Source:

The issue was notified to Barco through Barco’s responsible disclosure program by security researcher Murat Aydemir.

Affected products:

Barco Control Room Management Suite web application all versions before 3.14.1 release.

Fixed software:

The fix is available as part of Barco’s TransForm N 3.14.1 release. It is highly recommended to apply the fixes as part of this package. Further details of the release package are available in the release notes here.

TransForm N (TFN) stands for Barco’s visualization platform, consisting of display wall controller output nodes, input nodes, system and gateway nodes and the Control room Management software Suite (CMS). TransForm N helps control room professionals to collect all possible types of source data as well as organize and transform this source data in the most efficient and transparent way to create visual information on display walls.

Properties

Last updated Jun 14, 2022