Maksymilian Kubiakowi

The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the `name` field. However, the risk of exploiting this issue is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection.

The issue allows IP address spoofing by providing a custom value in the `X-Forwarded-For` header, which compromises the action logging mechanism's accountability.

The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then executed in the browser. The risk of exploitation is somewhat mitigated by the need to bypass the Content-Security-Policy.

The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use.

The issue allows for HTML code injection into the page content through the `content` field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.