Mindbreeze InSpire Vulnerabilities

This page lists known security vulnerabilities found in Mindbreeze InSpire. The article titles contain the Mindbreeze issue number and, in the case of third-party software, the official CVE number. Information about the affected components, severity level, current status and how to prevent the issue as well as hotfix information if applicable, can be found on the detail pages. You can also use the full text search to find specific vulnerabilities.

If you have found a possible security vulnerability, please contact Mindbreeze InSpire Support at support@mindbreeze.com providing detailed information about the problem found.

Vulnerabilities

ID: MINDBREEZE16264  Affected Components: Mindbreeze Inspire G6, Mindbreeze Inspire G7, Mindbreeze InSpire SaaS  Severity: 7.5 High  Status: Final  First published: February 2, 2021  CVEs: CVE-2019-17566 Summary The Mindbreeze ImageIO Filter is using Apache Batik to filter SVGs, which is vulnerable to server-side request forgery, caused by improper input validation. Remediation Hotfix Information Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE16261  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 7.5 High  Status: Final  First published: February 2, 2021  CVEs: CVE-2014-0107 Summary The Apache Xalan TransformerFactory does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources. Remediation Hotfix Information
ID: MINDBREEZE16259  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 7.5 High  Status: Final  First published: February 2, 2021  CVEs: CVE-2016-1000338, CVE-2016-1000341, CVE-2020-26939, CVE-2016-1000342 Summary The Bouncy Castle Update contains fixes for the following CVEs:
ID: MINDBREEZE15809  Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 8.2 Moderate  Status: Final  First published: February 2, 2021  CVEs: CVE-2020-10713, CVE-2020-14308, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707, CVE-2019-19527, CVE-2019-19537, CVE-2020-8647, CVE-2020-12826, CVE-2020-11565, CVE-2020-10732, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698  Summary The Kernel and GRUB Update contains fixes for the following CVEs:
ID: MINDBREEZE15801  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7  Severity: 6.1 Medium  Status: Final  First published: February 2, 2021  Summary The Filemanager Component, requiring administrative privileges by default does not show system files. By knowing the exact file name the files can be displayed. Remediation Hotfix Information Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS:
ID: MINDBREEZE15601  Affected Components: Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 6.2 Medium  Status: Final  First published: February 2, 2021  Summary Privileged Role "InSpire Index Writer" is able to perform configuration posts that the index writer does not have access.  Remediation Hotfix Information Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: Mindbreeze InSpire 20.5 Release (Version 20.5.1.835) Mindbreeze InSpire SaaS 20.5 Release (Version 20.5.1.835)
ID: MINDBREEZE15232  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 3.5 Low  Status: Final  First published: 14.10.2020  Summary In mustache version 2.2.1, it is no longer possible to pass executable code via input files. This is patched in the vendor mustache.js Severity: AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N Impact This vulnerability may allow running cross-site scripting (XSS) attacks via input filelds in mustache templates. Remediation Hotfix Information
ID: MINDBREEZE15136  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 6.1 Medium  Status: Final  First published: February 2, 2021  CVEs: CVE-2020-11023  Summary In jQuery, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. Remediation Hotfix Information
ID: MINDBREEZE15034  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 4.8 Medium  Status: Final  First published: 14.10.2020  CVEs: CVE-2020-14583, CVE-2020-14593, CVE-2020-14556, CVE-2020-14578, CVE-2020-14579, CVE-2020-14621, CVE-2020-14577   Summary OpenJDK Security Update 8u262 contains fixes for the following CVEs:
ID: MINDBREEZE14915  Affected Components: Mindbreeze InSpire G6, Mindbreeze InSpire G7, Mindbreeze InSpire SaaS  Severity: 6.1 Medium  Status: Final  First published: 14.10.2020  CVEs: CVE-2020-11022  Summary In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.