Unknown · Dingo Dlibra · CVE-2024-7124
**Name of the Vulnerable Software and Affected Versions**
DInGO dLibra software versions 6.0 through 6.3.19
**Description**
The issue is related to improper neutralization of input during web page generation, allowing a Reflected Cross-Site Scripting (XSS) attack. This occurs in the `filter` parameter of the "indexsearch" endpoint. An attacker could trick a user into using a crafted URL, causing a script to run in the user's browser.
**Recommendations**
For versions 6.0 through 6.3.19, update to version 6.3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the "indexsearch" endpoint or avoiding the use of the `filter` parameter until the issue is resolved.