Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote mailer form. An administrator who can edit a client can store attribute-breaking input, and, when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. The script runs in the InvoicePlane origin and can perform same-origin actions with the victim's session. This issue is fixed in version 1.7.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
InvoicePlane InvoicePlane
< 1.7.2affected
References
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-477r-xmgc-vcvj ↗
- https://github.com/InvoicePlane/InvoicePlane/pull/1635 ↗
- https://github.com/InvoicePlane/InvoicePlane/commit/1e74c032ff1c65e6a4f9d173505f415c3a539f57 ↗
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 ↗