✍️ Description

A malicious actor is able to add "new Retrospective" with a malicious payload, and upon opening the research menu, the XSS payload is being executed.

🕵️‍♂️ Proof of Concept

• 1; Log in with a proper roled user
• 2; Add a new board to the system at Retrospective menu on the left
• 3; Insert the following payload in the name field: <script>alert(document.cookie)</script>
• 4; Open the Retrospective menu, and the xss payload is being executed.

💥 Impact

With such opprotunity, the malicious actor is able to gather session identifiers from any users. Upon receiving this information, the Confidentiality, Integrity is compromised of the target's account.