CVE-2021-26710

Name of the Vulnerable Software and Affected Versions Redwood Report2Web versions 4.3.4.5 and 4.5.3

Description A cross-site scripting (XSS) issue in the login panel allows remote attackers to inject JavaScript via the "signIn.do" API endpoint, specifically through the urll parameter. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Redwood Report2Web version 4.3.4.5, consider disabling the signIn.do API endpoint until a patch is available. For Redwood Report2Web version 4.5.3, restrict access to the urll parameter in the signIn.do API endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the urll parameter in the signIn.do API endpoint until the issue is resolved.