<html theme="themeKey88rand710" iconset="monochrome"><head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body
text="#000000">
<br>
We are pleased to announce the immediate availability of IXP Manager
v6.3.1.
<br>
<br>
<p>This release primarily fixes a number of XSS security issues in IXP
Manager. These were discovered and responsibly disclosed by the GRNET IT
Security Team and we thank them for that.</p>
<p>This release is a bugfix release and so there are no database schema
changes.</p>
<br>
Full details are available at:
<br>
<br>
<a href="https://github.com/inex/IXP-Manager/releases/tag/v6.3.1">https://github.com/inex/IXP-Manager/releases/tag/v6.3.1</a><br>
<br>
<br>
<span style="text-decoration: underline;"><span style="font-weight:
bold;">Additional note regarding the security updates:
</span></span><br>
<br>
This release includes a fix for five XSS security bugs.
<p>We judge four of these bugs have a CVSS score of
CVSS:0.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N. These can only be
exploited by an authenticated superadmin user who would enter
specifically crafted JavaScript code in specific input fields.</p>
<p>The final we judge as CVSS:4.6/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
as an attack exploiting this could be possible from a sufficiently
sophisticated and motivated non-admin user who could find a way to
inject a XSS payload into a logged database object and could then
convince a superadmin to view that database change in the UI log tool. </p>
<p>Credit to the GRNET IT Security Team for responsibly disclosing these
issues.</p>
<br>
<br>
<div class="moz-signature"><br>
Kind regards,
<br>
Barry O'Donovan
<br><br>
</div>
</body>
</html>