Version: Up to 7.6.3 (inclusive)
Reflected XSS vulnerability in ObjectPlanet Opinio up to version 7.6.3.
The /admin/reportPortal.do page is vulnerable to reflected XSS attacks through the userLanguage GET parameter. This page is available to remote, unauthenticated users.
Proof of concept
Upgrade to version 7.6.4 or later.
2017-03-31 Vulnerability discovered
2017-04-01 Asked vendor how they prefer to receive vulnerability reports
2017-04-03 First response from vendor
2017-04-04 PoC sent to vendor
2017-04-05 Vendor confirms vulnerability. Patch will be included in next release within a few weeks.
2017-04-20 Patch released in version 7.6.4 - "Improved: Fixed some cross-site scripting vulnerabilities." http://www.objectplanet.com/opinio/changelog.html
2017-07-02 CVE Requested and received - "Use CVE-2017-10798."
2017-07-09 Public disclosure
Discovered by Kasper Karlsson