CyberRota Analysis
AI-GeneratedUnblu Spark is vulnerable to an open redirect flaw that can be exploited to perform a DOM-based cross-site scripting (XSS) attack when deployed with the configuration com.unblu.identifier.siteEmbeddedSetup=true. This vulnerability allows attackers to inject JavaScript that executes with full access to the host application's cookies, DOM, and same-origin APIs, potentially compromising the entire application. Organizations using on-premises deployments with this configuration should prioritize remediation due to the critical risk posed by the expanded attack surface.
Original NVD Description
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.