CVE-2021-23836

Name of the Vulnerable Software and Affected Versions: flatCore versions prior to 2.0.0 build 139

Description: A stored XSS issue was identified in the prefs smtp psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.

Recommendations: For versions prior to 2.0.0 build 139, consider disabling the prefs smtp psw parameter in the acp interface until a patch is available. Restrict access to the acp interface to minimize the risk of exploitation. Avoid using the prefs smtp psw parameter in the affected HTTP request body until the issue is resolved.