---
title: "Comala Document Management Security Advisory 2020-12-09"
canonical: "https://support.appfire.com/space/CDML/649859441/Comala%20Document%20Management%20Security%20Advisory%202020-12-09"
format: markdown
---
> Macro (aura-html)


This advisory discloses a security vulnerability found and fixed in Comala Document Management. We recommend upgrading Comala Document Management to the latest supported version.

## Affected Versions

The vulnerability affects **Comala Document Management 6.4.0 → 6.13.0**

The **[6.13.1](https://appfire.atlassian.net/wiki/spaces/CDML/pages/649725033)**** release contains a fix** for the issue mentioned below.

Versions prior to 6.4.0 are not affected.

## XSS Vulnerabilities

### Severity

<span style="color: #333333">Comalatech rates the severity of these issues as </span><span style="color: #333333">**Medium **</span><span style="color: #333333">according to the published </span><span style="color: #333333">[Atlassian Security Levels](https://www.atlassian.com/security/security-severity-levels)</span><span style="color: #333333">.</span>

<span style="color: #333333">We have ranked the vulnerability as medium because: </span>

- <span style="color: #333333">a registered user with edit permissions over pages or blog posts in the application could do the following: </span>
  - <span style="color: #333333">session riding</span>
  - <span style="color: #333333">stealing information and cookies</span>
  - <span style="color: #333333">creating a phishing page within the domain</span>

<span style="color: #333333">This is an independent assessment and you should evaluate its applicability to your own IT environment.</span>

### Description

<span style="color: #333333">We have fixed a cross-site scripting vulnerability introduced in Comala Document Management 6.4.0. The vulnerability could allow any user with edit permission to use another user's session.</span>

### Risk Mitigation

<span style="color: #333333">Sites running</span> 6.4.0-6.13.0 are recommended to upgrade to Comala Document Management to [6.13.1](https://appfire.atlassian.net/wiki/spaces/CDML/pages/649725033).

:red_star:<span style="color: #333333"> If upgrading immediately is not possible, please disable the application until you can upgrade it.</span>