Enable Media Replace up to and including 4.1.8 renders the ‘location_dir’ value into an HTML attribute on the media replace screen without escaping it. An authenticated attacker with Author-level access or above can break out of the attribute and inject arbitrary JavaScript, which then executes for any user who views the affected page.
This vulnerability affects the following application versions:
- Enable Media Replace 3.5.0
- Enable Media Replace 3.6.0
- Enable Media Replace 3.6.1
- Enable Media Replace 3.6.2
- Enable Media Replace 3.6.3
- Enable Media Replace 4.0.0
- Enable Media Replace 4.0.1
- Enable Media Replace 4.0.2
- Enable Media Replace 4.0.3
- Enable Media Replace 4.1.0
- Enable Media Replace 4.1.1
- Enable Media Replace 4.1.2
- Enable Media Replace 4.1.3
- Enable Media Replace 4.1.4
- Enable Media Replace 4.1.5
- Enable Media Replace 4.1.6
- Enable Media Replace 4.1.7
- Enable Media Replace 4.1.8