CVE-2017-20116

Name of the Vulnerable Software and Affected Versions TrueConf Server version 4.3.7

Description The issue is related to the failure to neutralize script-related HTML tags on the /admin/group/list/ webpage of the TrueConf Server software. This can allow a remote attacker to perform cross-site scripting attacks by manipulating the checked group id argument. The attack can be launched remotely.

Recommendations For TrueConf Server version 4.3.7, consider disabling access to the /admin/group/list/ webpage until a patch is available. Restrict the use of the checked group id argument in the affected webpage to minimize the risk of exploitation.