Cross-Site Scripting in LEX Baza Dokumentów
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely processes the parameter on the client side, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser. An attacker with ability to set a cookie can perform a more severe attack, so we evaluate the impact and risk of exploitation as minimal. However, the vendor considered this a vulnerability and released a security patch. This issue was fixed in version 1.3.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wolters Kluwer Polska | LEX Baza Dokumentów | before 1.3.4 | 1.3.4 | Patch available | CNA |
- LEX Baza Dokumentów VendorWolters Kluwer Polska Affected before 1.3.4 Fixed in 1.3.4 Patch available CNA
Remediation
- Fix · CNA LEX Baza Dokumentów (Wolters Kluwer Polska) Fixed in 1.3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1493
- 2026-10-03 Alias added: GHSA-qh5j-h84r-q47c
References
Sources
- CVE-2026-1493 · CVE Program
- CVE-2026-1493 · NVD
- FIRST EPSS
- GHSA-qh5j-h84r-q47c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences