Shoodagiri

An unintended proxy or intermediary, known as a confused deputy, in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. A confused deputy is a security situation where a privileged entity is tricked by a less privileged entity into performing an action on its behalf.

Failure to escape certain variables during the composition of error pages allows an attacker with permissions to edit site configurations to execute malicious code by injecting JavaScript into those values.