Summary

A security vulnerability (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N - 8.5 High) was identified in the WebAdmin interface. Discovered Server names received via network discovery were rendered as raw HTML without proper sanitization. A network-adjacent attacker could deploy a rogue server with a malicious script embedded in its system name, triggering a Cross-Site Scripting (XSS) execution when an authenticated administrator opens the site-merge interface.

Cause

Remote server names provided during peer discovery (specifically the systemName parameter) were inserted directly into the Document Object Model (DOM) instead of being rendered as plain text.

Impact

Successful exploitation executes attacker-controlled JavaScript in the administrator's browser, allowing the attacker to steal the administrator's session token and gain full administrative access to the site without knowing any credentials.                                                                                                   

 Exploitation requires an attacker-controlled server on the same network segment and an administrator opening the "Merge with Another Site" dialog.

Resolution

Our team addressed the root cause by applying proper HTML entity encoding and strict UI rendering rules for all external and remote-supplied server metadata. Server names are now safely handled as untrusted plaintext strings.

Mitigation

This issue has been fully resolved in version 6.1.3 and newer.

To secure your deployment, upgrade the VMS to version 6.1.3 or higher. No workarounds or additional configuration changes are required once updated.