CVE:CVE-2021-46827
CNNVD:CNNVD-202207-1233
Syncro Soft Oxygen XML WebHelp是罗马尼亚Syncro Soft公司的用于 DITA 和 DocBook 资源转换为 WebHelp 输出。
Syncro Soft Oxygen XML WebHelp 22.1  build 2021082006之前版本，23.1 build 2021090310之前的23.x版本存在安全漏洞，该漏洞源于搜索词建议(使用Oxygen XML WebHelp生成的在线文档)中的XSS漏洞允许攻击者通过说服用户在WebHelp输出搜索字段中输入特定的文本来执行JavaScript。
solution:Upgrade sync oxygen_publishing_engine to a higher version than 22.1,22.1:2020061014,22.1:2020072823,22.1:2020100801,22.1:2020121711,23.1:2021040717,23.1:2021060401,and avoid the version (,22.1),22.1:2020061014,22.1:2020072823,22.1:2020100801,22.1:2020121711,23.1:2021040717,23.1:2021060401; Upgrade sync oxygen_xml_author to a higher version than 22.1,22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407,and avoid the version (,22.1),22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407; Upgrade sync oxygen_xml_developer to a higher version than 22.1,22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407,and avoid the version (,22.1),22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407; Upgrade sync oxygen_xml_editor to a higher version than 22.1,22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407,and avoid the version (,22.1),22.1:2020061102,22.1:2020072902,22.1:2020100710,22.1:2020121713,23.1:2021030206,23.1:2021040908,23.1:2021061407; Upgrade sync oxygen_xml_webhelp to a higher version than 22.1,22.1:2020061014,22.1:2020072412,22.1:2020100208,22.1:2020121713,23.1:2021030210,23.1:2021040711,23.1:2021060306,and avoid the version (,22.1),22.1:2020061014,22.1:2020072412,22.1:2020100208,22.1:2020121713,23.1:2021030210,23.1:2021040711,23.1:2021060306