CVE-2021-37195

Name of the Vulnerable Software and Affected Versions COMOS versions V10.2 through V10.4.1, but only if web components are used, specifically: COMOS V10.2 COMOS versions V10.3 through V10.3.3.2 COMOS versions V10.4 through V10.4.0

Description A vulnerability has been identified in the COMOS Web component, which accepts arbitrary code as an attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment.

Recommendations For COMOS V10.2, consider disabling the web component until a patch is available. For COMOS versions V10.3 through V10.3.3.2, consider disabling the web component until a patch is available. For COMOS versions V10.4 through V10.4.0, consider disabling the web component until a patch is available.